PT-2026-36171 · Sscms · Sscms

Hss94531 · Published 2026-04-30 · Updated 2026-04-30 · CVE-2026-7429

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SSCMS version 7.4.0

Description A reflected cross-site scripting issue exists in the STL processing endpoint. Attackers can execute arbitrary JavaScript by crafting malicious STL template payloads that are decrypted and returned without proper sanitization. Specifically, improper output encoding in the "/api/stl/actions/dynamic" endpoint allows the injection of executable JavaScript into JSON responses, which can lead to session hijacking, phishing attacks, and unauthorized actions performed on behalf of users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-7429

Affected Products

Sscms

References · 6

• 🔥 https://github.com/siteserver/cms/issues/3892 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7429 · Security Note
• https://github.com/siteserver/cms · Note
• https://twitter.com/CVEnew/status/2049956005111640486 · Twitter Post
• https://twitter.com/infoflowcloud/status/2049957479467856058 · Twitter Post
• https://vulncheck.com/advisories/sscms-reflected-cross-site-scripting-via-stl-processing · Note