{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"4.4.01"}],"component":"nukeviet/nukeviet","cve_ids":["CVE-2026-41147"],"ecosystem":"Packagist","epss":0.00609,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-64rr-pp78-62ww","id":"tcs_01M5KEWMKNAJMQ8GH0FHDTY3FE","modified_at":"2026-09-10T03:50:45.698842200Z","published_at":"2026-05-15T16:45:03Z","references":["https://osv.dev/vulnerability/GHSA-64rr-pp78-62ww","https://github.com/nukeviet/nukeviet/security/advisories/GHSA-64rr-pp78-62ww","https://nvd.nist.gov/vuln/detail/CVE-2026-41147","https://github.com/nukeviet/nukeviet/commit/2a0860fbe22e2f6a3b90f802bf80b25e18699611","https://github.com/nukeviet/nukeviet","https://github.com/nukeviet/nukeviet/releases/tag/4.5.08"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-64rr-pp78-62ww","url":"https://osv.dev/vulnerability/GHSA-64rr-pp78-62ww"}],"summary":"NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class"}