{"affected":[{"product":"XBackBone","source":"CNA: VulDB","vendor":"sergix44","versions":[{"status":"affected","version":"3.8.0"},{"status":"affected","version":"3.8.1"},{"status":"affected","version":"3.8.2"}]}],"cveId":"CVE-2026-129267","cwes":["CWE-79","CWE-94"],"description":"A vulnerability was found in sergix44 XBackBone up to 3.8.2. Impacted is the function MediaController::getRawById of the file app/Controllers/MediaController.php. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.1,"severity":"medium","source":"CNA: VulDB","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","version":"4.0"},{"score":3.5,"severity":"low","source":"CNA: VulDB","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C","version":"3.1"},{"score":3.5,"severity":"low","source":"CNA: VulDB","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C","version":"3.0"},{"score":4,"severity":"medium","source":"CNA: VulDB","vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C","version":"2.0"}],"modifiedAt":1794676516620,"publishedAt":1794676516620,"references":[{"source":"CNA: VulDB","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/vuln/437311"},{"source":"CNA: VulDB","tags":["signature","permissions-required"],"url":"https://vuldb.com/vuln/437311/cti"},{"source":"CNA: VulDB","tags":["third-party-advisory"],"url":"https://vuldb.com/cve/CVE-2026-129267"},{"source":"CNA: VulDB","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/1043413"},{"source":"CNA: VulDB","tags":["issue-tracking","patch"],"url":"https://github.com/sergix44/xbackbone/pull/673"},{"source":"CNA: VulDB","tags":["product"],"url":"https://github.com/sergix44/xbackbone/"}],"remediation":[{"kind":"fix","source":"CNA: VulDB","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/sergix44/xbackbone/pull/673"}],"revision":"06d8a19128681f8d721551fcac62c661e90667dfbaa8d7b28cebdd3876ab0662","sources":[{"modifiedAt":1794676516620,"name":"CNA: VulDB","retrievedAt":1794679700661,"url":"https://www.cve.org/CVERecord?id=CVE-2026-129267"}],"ssvc":null,"status":"published","title":"sergix44 XBackBone MediaController.php getRawById cross site scripting","updatedAt":1794679700661}