CVE-2026-67175

MediumCVSS 4.6/10Last modified Nov 12, 2026

Description

Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a malicious payload in the user profile page that executes when another user views the attacker's profile. Fixed 2026-07-17.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Chargemap	Chargemap	< 2026-07-17

References

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-671765.4Chargemap contains an open redirect vulnerability in the authentication login endpoint. A remote, unauthenticated attacker could send a craf CVE-2026-671775.4Chargemap contains a stored cross site scripting vulnerability. A remote, unauthenticated attacker could craft a payload in the username fie CVE-2026-671787.8MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: R CVE-2026-671797.8Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS r CVE-2026-67186.2IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files.CVE-2026-671808.4Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence CVE-2026-671815.4Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boun CVE-2026-671827.5Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injec CVE-2026-671837.5TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordi CVE-2026-671847.5TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker process CVE-2026-671857.5TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ..CVE-2026-671877.1Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attac