Low severity · published Jun 29, 2026
CVE-2026-13558
CodeAstro Complaint Management System Report addreport cross site scripting
3.5
CVSS
0.3%
EPSS
No
On KEV
Description
A security flaw has been discovered in CodeAstro Complaint Management System 1.0. This issue affects some unknown processing of the file /report/addreport of the component Report Handler. Performing a manipulation of the argument Report Title results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Complaint Management System · CodeAstro
1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13558
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13558
codeastro.com
https://codeastro.com/
github.com
https://github.com/ashikmd0507/CVE/blob/main/Stored%20XSS%20in%20Report%20Title%20Field%20Allows%20Script%20Execution%20in%20Admin%20Panel/README.md
vuldb.com
https://vuldb.com/cve/CVE-2026-13558
vuldb.com
https://vuldb.com/submit/843714
vuldb.com
https://vuldb.com/vuln/374566
vuldb.com
https://vuldb.com/vuln/374566/cti
More from Complaint Management System
9.8
CVE-2024-55507
An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the delete_e.php component
9.8
CVE-2024-55509
SQL injection vulnerability in CodeAstro Complaint Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via the id parameter of the…
8.8
CVE-2024-55506
An IDOR vulnerability in CodeAstro's Complaint Management System v1.0 (version with 0 updates) enables an attacker to execute arbitrary code and obtain sensitive information via…
8.8
CVE-2024-55505
An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the mess-view.php component
7.5
CVE-2024-56889
Incorrect access control in the endpoint /admin/m_delete.php of CodeAstro Complaint Management System v1.0 allows unauthorized attackers to arbitrarily delete complaints via…