CVE-2026-41147

NukeViet CMS is a multi Content Management System. Versions 4.5.07 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient server-side input sanitization in the Request class. The application relies primarily on client-side filtering to sanitize HTML tags and attributes in user-submitted content, which can be bypassed by intercepting and modifying HTTP requests directly (e.g., using Burp Suite). An attacker can inject malicious payloads which are stored server-side and executed in the browser of any user who views the content. Anyone viewing user-submitted content (such as administrators and moderators reviewing contact messages or comments) is impacted, and the vulnerability can be exploited by any anonymous visitor without authentication, with the Contact module used only as a proof of concept. Potential consequences include session hijacking through cookie theft, unauthorized actions performed under the victim's identity, defacement or redirection to phishing pages, and phishing attacks via manipulated email notifications. This issue has been fixed in version 4.5.08. If developers are unable to upgrade immediately, they should work around this issue by implementing server-side HTML sanitization in the Request class to strip or encode dangerous tags and attributes (e.g., <iframe>, srcdoc, event handlers like onerror/onload), enforcing a Content Security Policy (CSP) to restrict inline script execution, and set cookies with the HttpOnly flag to mitigate cookie theft via XSS.

• CWE-79

• https://github.com/nukeviet/nukeviet/commit/2a0860fbe22e2f6a3b90f802bf80b25e18699611
• https://github.com/nukeviet/nukeviet/releases/tag/4.5.08
• https://github.com/nukeviet/nukeviet/security/advisories/GHSA-64rr-pp78-62ww

Published

May 22, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41141EspoCRM is an open source customer relationship management a…6.5
• CVE-2026-41142OpenEXR provides the specification and reference implementat…8.8
• CVE-2026-41143YesWiki is a wiki system written in PHP. Prior to version 4.…8.8
• CVE-2026-41144F´ (F Prime) is a framework that enables development and dep…9.8
• CVE-2026-41145MinIO is a high-performance object storage system. Starting …8.2
• CVE-2026-41146facil.io is a C micro-framework for web applications. Prior …8.7
• CVE-2026-41148Mermaid is a JavaScript tool that uses Markdown-inspired tex…5.3
• CVE-2026-41149Mermaid is a JavaScript tool that uses Markdown-inspired tex…5.3
• CVE-2026-4115A vulnerability was detected in PuTTY 0.83. Affected is the …3.7
• CVE-2026-41150Mermaid is a JavaScript tool that uses Markdown-inspired tex…5.3
• CVE-2026-41153In JetBrains Junie before 252.549.29 command execution was p…9.8
• CVE-2026-41154Software installed and run as a non-privileged user may caus…7.8