CVE-2026-77838
Deferred Deferred - Pending Action

Cross-Site Scripting (XSS) in SOY Calendar

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: JPCERT/CC

Description
SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-77838
EUVD
EUVD-2026-67577

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
tsuyoshi_saito soy_calendar to 2.5.0 (exc)
tsuyoshi_saito soy_calendar 2.5.0
tsuyoshi_saito soy_cms 3.25.0
tsuyoshi_saito soy_gallery 2.1.0
tsuyoshi_saito soy_inquiry 2.11.0
tsuyoshi_saito soy_shop 2.15.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SOY Calendar has a cross-site scripting (XSS) vulnerability. This means an attacker can inject malicious scripts into the web pages viewed by users who log in to the product. These scripts can then execute arbitrary actions in the user's browser.

Detection Guidance

To detect this XSS vulnerability in SOY Calendar, inspect web application logs for unusual script execution or input patterns. Check for outdated versions of SOY Calendar (2.4.0 or earlier) by reviewing installed software versions. Use vulnerability scanners like Nikto or OWASP ZAP to scan for XSS flaws in web applications.

Impact Analysis

This vulnerability could allow attackers to steal user session cookies, redirect users to malicious sites, or perform actions on behalf of logged-in users. It primarily affects users who log in to SOY Calendar versions 2.4.0 and earlier.

Compliance Impact

XSS vulnerabilities can lead to unauthorized data access or modification, which may violate GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations using affected SOY Calendar versions could face compliance risks if user data is compromised.

Mitigation Strategies

Immediately update SOY Calendar to version 2.5.0 or later from the official distribution page. Remove or disable any affected SOY series software if updates are unavailable. Monitor network traffic for suspicious activity and restrict user access to sensitive areas until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart