CVE-2026-36358
Cross Site Scripting in Juzaweb CMS 5.0.0
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| juzaweb | cms | 5.0.0 |
| juzaweb | juzaweb_cms | 5.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in Juzaweb CMS v5.0.0 that allows an authenticated administrator to inject malicious scripts which execute in users' browsers. This can lead to unauthorized actions or data theft.
Such unauthorized data access or theft can impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information from unauthorized disclosure or manipulation.
Therefore, exploitation of this vulnerability could result in violations of these standards due to potential compromise of user data confidentiality and integrity.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by verifying if the Juzaweb CMS version 5.0.0 is running and testing the /admin/banner-ads component for stored Cross-Site Scripting (XSS). An authenticated administrator can attempt to inject a script payload into the HTML banner ad body and observe if the script executes on the homepage.
A practical detection method involves logging into the admin panel, navigating to the banner ads section, and creating a new HTML-type banner with a script payload such as `<script>alert("XSS")</script>`. If the alert executes when visiting the homepage, the vulnerability is present.
There are no specific network commands provided in the resources, but manual testing via the web interface as described is the recommended approach.
Can you explain this vulnerability to me?
This vulnerability is a Cross Site Scripting (XSS) issue found in Juzaweb CMS version 5.0.0. It allows a remote attacker to execute arbitrary code by injecting a crafted script into the Add Banner Ads function.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can run arbitrary scripts in the context of the affected web application. This can lead to unauthorized actions such as stealing user session data, defacing the website, redirecting users to malicious sites, or executing other malicious activities.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the Cross Site Scripting (XSS) vulnerability in Juzaweb CMS v5.0.0, immediate steps include restricting access to the admin panel to trusted users only, especially the banner ads section where malicious scripts can be injected.
Administrators should avoid adding or approving any HTML banner ads containing untrusted or suspicious code.
Additionally, monitoring and sanitizing inputs in the banner ads HTML content can help prevent script injection.
If possible, temporarily disable the Add Banner Ads function or restrict its usage until a patch or update is available.