PT-2026-29448 · Bufanyun · Hotgo

Vuldb · Published 2026-04-01 · Updated 2026-04-01 · CVE-2026-5253

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions bufanyun HotGo versions 1.0 through 2.0

Description A weakness exists in bufanyun HotGo versions 1.0 and 2.0. The issue affects an unknown functionality within the /web/src/layout/components/Header/MessageList.vue file of the editNotice endpoint component. Manipulating this functionality can lead to cross site scripting (XSS). The attack can be launched remotely, and an exploit is publicly available. The vendor was contacted regarding this disclosure but did not respond.

Recommendations For versions 1.0 and 2.0, address the vulnerability in the /web/src/layout/components/Header/MessageList.vue file of the editNotice endpoint component to prevent cross site scripting.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-5253

Affected Products

Hotgo

References · 7

• 🔥 https://github.com/CC-T-454455/Vulnerabilities/tree/master/hotgo/vulnerability-2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5253 · Security Note
• https://twitter.com/CVEnew/status/2039279679916617912 · Twitter Post
• https://twitter.com/CVEarity/status/2039323841185624232 · Twitter Post
• https://vuldb.com/vuln/354443 · Note
• https://vuldb.com/vuln/354443/cti · Note
• https://vuldb.com/submit/780614 · Note