{"id":"CVE-2026-118585","kind":"vulnerability","aliases":["CVE-2026-118585"],"related":[],"title":"configuroweb inventariobasico: product name field allows cross-site scripting","description":"A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affects unknown code of the file addlist.php of the component Add Product Page. Such manipulation of the argument product name leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.","summary":"An unpatched web inventory app lets an attacker inject script through the product name argument of addlist.php. The script runs in the browser of anyone who views the affected page, which can expose their session or actions.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","php","self-hosted"],"not_affected_if":["no-public-access"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-29T00:17:25+00:00","first_seen_at":"2026-10-29T00:36:21+00:00","triaged_at":"2026-10-29T00:37:13+00:00","updated_at":"2026-10-29T00:37:13+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-29T00:37:13Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"configuroweb inventariobasico: product name field allows cross-site scripting","impact":"medium","summary":"An unpatched web inventory app lets an attacker inject script through the product name argument of addlist.php. The script runs in the browser of anyone who views the affected page, which can expose their session or actions.","category":"other","nicknames":[],"who_cares":["self-hosted","php"],"confidence":0.5,"needs_auth":"unknown","worst_case":"script runs in victims' browsers, session data exposed","analyst_note":"Check the NVD entry and the project's issue tracker for a fix commit or a version, and confirm whether the add-product form requires login.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-public-access"],"who_is_affected":"Teams that run configuroweb inventariobasico with the Add Product Page exposed to users. The sources name specific commits but no version, and the project has not responded to the report, so no fixed release is known. Installations where the add-product form is not reachable can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000545,"input_tokens":3420,"output_tokens":407,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118585':13A,16A '-2026':12A,15A 'action':58B 'add':79C 'addlist.php':38B,75C 'affect':50B,69C,128C 'allow':6A 'anyon':46B 'app':26B 'argument':36B,86C 'attack':29B,95C 'avail':104C 'basi':116C 'browser':44B 'c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab':66C 'code':71C 'compon':78C 'configuroweb':1A,64C 'consequ':120C 'continu':118C 'cross':8A,91C 'cross-sit':7A 'cve':11A,14A 'deliveri':119C 'detail':125C 'earli':139C 'either':127C 'ensur':117C 'exploit':101C 'expos':54B 'field':5A 'file':74C 'host':21B 'identifi':62C 'inform':135C 'inject':30B 'inventariobasico':2A,65C 'inventori':25B 'issu':142C 'launch':98C 'lead':89C 'let':27B 'manipul':83C 'may':96C 'might':106C 'name':4A,35B,88C 'oper':111C 'page':51B,81C 'php':18B 'problem':138C 'product':3A,34B,80C,87C,110C 'project':133C 'public':103C 'releas':115C,131C 'remot':99C 'report':143C 'respond':147C 'roll':114C 'run':41B 'script':10A,31B,40B,93C 'self':20B 'self-host':19B 'session':56B 'site':9A,92C 'unknown':70C 'unpatch':23B 'updat':130C 'use':108C 'version':124C 'view':48B 'vulner':60C,68C 'web':24B 'yet':148C","nicknames":[],"mitigations":[],"who_affected":"Teams that run configuroweb inventariobasico with the Add Product Page exposed to users. The sources name specific commits but no version, and the project has not responded to the report, so no fixed release is known. Installations where the add-product form is not reachable can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-29T00:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118585","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118585","severity":null,"published_at":"2026-10-29T00:17:25+00:00","modified_at":"2026-10-29T00:17:25+00:00","first_seen_at":"2026-10-29T00:36:21+00:00","fetched_at":"2026-10-29T00:36:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}