PT-2026-55765 · Stephen Kruger · Bluebox

Chor4O · Published 2026-07-05 · Updated 2026-07-05 · CVE-2026-14704

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions stephen-kruger bluebox versions prior to 4.5.13

Description An issue exists in an unknown functionality where manipulating the code argument allows for cross-site scripting (XSS), a technique used to inject malicious scripts into web pages viewed by other users. This attack can be initiated remotely.

Recommendations Update stephen-kruger bluebox to version 4.5.13 or later.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-14704

Affected Products

Bluebox

References · 10

• 🔥 https://github.com/stephen-kruger/bluebox/issues/32#issuecomment-4632135192 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-14704 · Security Note
• https://github.com/stephen-kruger/bluebox/issues/32 · Note
• https://twitter.com/infoflowcloud/status/2073657116879909020 · Twitter Post
• https://github.com/stephen-kruger/bluebox · Note
• https://twitter.com/CVEnew/status/2073655124476448853 · Twitter Post
• https://vuldb.com/vuln/376300 · Note
• https://vuldb.com/cve/CVE-2026-14704 · Note
• https://vuldb.com/vuln/376300/cti · Note
• https://vuldb.com/submit/847357 · Note