CVE-2026-30918

{"id": "CVE-2026-30918", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2026-03-10T17:40:15.667", "references": [{"url": "https://github.com/facileManager/facileManager/security/advisories/GHSA-284f-mff7-744x", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , a reflected XSS occurs when an application receives data from an untrusted source and uses it in its HTTP responses in a way that could lead to vulnerabilities. It is possible to inject malicious JavaScript code into a URL by adding a script in a parameter. This vulnerability was found in the fmDNS module. The parameter that is vulnerable to an XSS attack is log_search_query. This vulnerability is fixed in 6.0.4."}, {"lang": "es", "value": "facileManager es una suite modular de aplicaciones web dise\u00f1ada pensando en el administrador de sistemas. Antes de la versi\u00f3n 6.0.4, se produce un XSS reflejado cuando una aplicaci\u00f3n recibe datos de una fuente no confiable y los utiliza en sus respuestas HTTP de una manera que podr\u00eda generar vulnerabilidades. Es posible inyectar c\u00f3digo JavaScript malicioso en una URL a\u00f1adiendo un script en un par\u00e1metro. Esta vulnerabilidad fue encontrada en el m\u00f3dulo fmDNS. El par\u00e1metro que es vulnerable a un ataque XSS es log_search_query. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 6.0.4."}], "lastModified": "2026-03-13T14:55:46.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:facilemanager:facilemanager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ACF32B72-7187-4B8C-B452-67ACBA089B76", "versionEndExcluding": "6.0.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}