{"id":"CVE-2026-67177","kind":"vulnerability","aliases":["CVE-2026-67177"],"related":[],"title":"Chargemap: stored cross-site scripting through the registration username field","description":"Chargemap contains a stored cross site scripting vulnerability. A remote, unauthenticated attacker could craft a payload in the username field of the account registration page and associate the new account with a victim's email. The attacker could send a forgotten password request to the victim, and the payload would execute when a victim opens the link. Fixed 2026-07-17.","summary":"Chargemap does not sanitize the username field on account registration, so an attacker can store a script in it. The script runs in a victim's browser when they open the password-reset link the attacker triggers.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chargemap","other","self-hosted"],"not_affected_if":["registration-disabled"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T22:19:18+00:00","first_seen_at":"2026-11-10T22:27:30+00:00","triaged_at":"2026-11-10T22:30:44+00:00","updated_at":"2026-11-10T22:30:44+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T22:30:44Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Chargemap: stored cross-site scripting through the registration username field","impact":"medium","summary":"Chargemap does not sanitize the username field on account registration, so an attacker can store a script in it. The script runs in a victim's browser when they open the password-reset link the attacker triggers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["chargemap","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"script runs in victim's browser session on the Chargemap site","analyst_note":"Find the vendor's advisory or project changelog to confirm affected and fixed versions and the upgrade path.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["registration-disabled"],"who_is_affected":"Chargemap is a service that lets an attacker register accounts with arbitrary usernames and link them to a victim's email address. Teams running Chargemap, or a deployment of it, with open registration are exposed. The sources do not say which versions are affected or whether any fixed version exists beyond the stated 2026-07-17 fix date.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":4547,"output_tokens":449,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-07':120C '-17':121C '-2026':13A,16A '-67177':14A,17A '2026':119C 'account':31B,83C,90C 'associ':87C 'attack':35B,59B,72C,97C 'browser':49B 'chargemap':1A,18B,23B,61C 'contain':62C 'could':73C,98C 'craft':74C 'cross':4A,65C 'cross-sit':3A 'cve':12A,15A 'email':95C 'execut':111C 'field':11A,29B,80C 'fix':118C 'forgotten':101C 'host':22B 'link':57B,117C 'new':89C 'open':52B,115C 'page':85C 'password':55B,102C 'password-reset':54B 'payload':76C,109C 'registr':9A,32B,84C 'remot':70C 'request':103C 'reset':56B 'run':44B 'sanit':26B 'script':6A,39B,43B,67C 'self':21B 'self-host':20B 'send':99C 'site':5A,66C 'store':2A,37B,64C 'trigger':60B 'unauthent':71C 'usernam':10A,28B,79C 'victim':47B,93C,106C,114C 'vulner':68C 'would':110C","nicknames":[],"mitigations":[],"who_affected":"Chargemap is a service that lets an attacker register accounts with arbitrary usernames and link them to a victim's email address. Teams running Chargemap, or a deployment of it, with open registration are exposed. The sources do not say which versions are affected or whether any fixed version exists beyond the stated 2026-07-17 fix date.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["chargemap","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-67177':14A,17A 'chargemap':1A 'cross':4A 'cross-sit':3A 'cve':12A,15A 'field':11A 'registr':9A 'script':6A 'site':5A 'store':2A 'usernam':10A","search_b":"'account':31B 'attack':35B,59B 'browser':49B 'chargemap':18B,23B 'field':29B 'host':22B 'link':57B 'open':52B 'password':55B 'password-reset':54B 'registr':32B 'reset':56B 'run':44B 'sanit':26B 'script':39B,43B 'self':21B 'self-host':20B 'store':37B 'trigger':60B 'usernam':28B 'victim':47B","search_c":"'-07':120C '-17':121C '2026':119C 'account':83C,90C 'associ':87C 'attack':72C,97C 'chargemap':61C 'contain':62C 'could':73C,98C 'craft':74C 'cross':65C 'email':95C 'execut':111C 'field':80C 'fix':118C 'forgotten':101C 'link':117C 'new':89C 'open':115C 'page':85C 'password':102C 'payload':76C,109C 'registr':84C 'remot':70C 'request':103C 'script':67C 'send':99C 'site':66C 'store':64C 'unauthent':71C 'usernam':79C 'victim':93C,106C,114C 'vulner':68C 'would':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:19:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"9119a7d8-5eab-497f-8521-727c672e3725","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67177","severity":null,"published_at":"2026-11-10T22:19:18+00:00","modified_at":"2026-11-10T22:19:18+00:00","first_seen_at":"2026-11-10T22:27:30+00:00","fetched_at":"2026-11-10T22:27:30+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}