MEDIUMCVSS v3.1 6.1Vulnerability
CVE-2026-129170
FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which returns unsanitized text when the marked parser throws. Unauthenticated attackers can share text with thousands of nested blockquote markers followed by HTML payloads, executing script that steals the admin token from localStorage.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Cvss score
- 6.1
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-14T00:50:05+00:00
- Score
- 6.1
- Last source
- NVD
- Cvss version
- 3.1
- Cve id
- CVE-2026-129170
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- First seen by Signal
- 2026-11-13T20:38:23+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Published at
- 2026-11-13T18:17:42.360
- Last modified
- 2026-11-13T18:17:42.487
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph