PT-2026-49163 · Intelliants · Subrion Cms

Karina Gante + 1 · CVE-2026-12202 · Published 2026-06-15 · Updated 2026-06-15

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS versions prior to 4.0.4

Description Cross site scripting is possible via the Blocks Endpoint. Remote attackers can exploit this by manipulating the CSS class name argument. Cross site scripting is a type of security flaw that allows attackers to inject malicious scripts into web pages viewed by other users.

Recommendations Update to a version newer than 4.0.3. As a temporary workaround, restrict access to the Blocks Endpoint to minimize the risk of exploitation.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-12202

Affected Products

Subrion Cms

References · 10

• 🔥 https://karinagante.github.io/cve-2026-12202/#proof-of-concept-poc · Exploit
• 🔥 https://hackmd.io/@noka/B1sue5Xkzl · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12202 · Security Note
• https://vuldb.com/submit/830013 · Note
• https://vuldb.com/vuln/370845/cti · Note
• https://twitter.com/VulmonFeeds/status/2066359765299544512 · Twitter Post
• https://karinagante.github.io/cve-2026-12202 · Note
• https://vuldb.com/cve/CVE-2026-12202 · Note
• https://vuldb.com/vuln/370845 · Note
• https://t.me/CVEtracker/56824 · Telegram Post