CVE-2026-32774

Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers.

Score

CVSS 3.1 6.4 Medium

Status

Analyzed - disclosure@vulncheck.com

Published

2026-03-16

Last modified

2026-10-08

Weaknesses

CWE-79

Affected products

• Vulnogram (Vulnogram)

References

• https://github.com/Vulnogram/Vulnogram/security/advisories/GHSA-pg4p-2985-gvxr
• https://github.com/Vulnogram/Vulnogram
• https://www.vulncheck.com/advisories/vulnogram-stored-cross-site-scripting-via-comment-hypertext
• https://github.com/Vulnogram/Vulnogram/commit/2f0e21b113c58124084c7b74c9768fc241126a05