Packagist/nukeviet/nukeviet CVE-2026-41147: high 8.7, EPSS 0.61%
NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 4.4.01 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-64rr-pp78-62ww
- https://github.com/nukeviet/nukeviet/security/advisories/GHSA-64rr-pp78-62ww
- https://nvd.nist.gov/vuln/detail/CVE-2026-41147
- https://github.com/nukeviet/nukeviet/commit/2a0860fbe22e2f6a3b90f802bf80b25e18699611
- https://github.com/nukeviet/nukeviet
- https://github.com/nukeviet/nukeviet/releases/tag/4.5.08
CVE-2026-41147 · published · modified · JSON