CVE-2026-41575 - Vulnerability Analysis
MediumCVSS: 6.1Last Updated: May 8, 2026
th30d4y/IP - Stored XSS
Published: May 8, 2026Updated: May 8, 2026PoC AvailableRemote Exploitable
Overview
th30d4y/IP 1.0.1 to < 2.0.1 contains a stored XSS caused by unsanitized user input rendered in the browser, letting attackers execute arbitrary JavaScript, exploit requires victim to load malicious input.
Severity & Score
Severity: Medium
CVSS Score: 6.1
Impact
Attackers can execute arbitrary JavaScript in victim's browser, potentially stealing data or performing actions on behalf of the user.
Mitigation
Update to version 2.0.1.
Related Resources
Details
- CVE ID
- CVE-2026-41575
- Severity
- Medium
- CVSS Score
- 6.1
- Type
- stored_xss
- Status
- unconfirmed
CWE
- CWE-79
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N