CVE-2026-78238
Deferred Deferred - Pending Action

Cross-Site Scripting (XSS) Vulnerability in SOY Gallery

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: JPCERT/CC

Description
SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-78238
EUVD
EUVD-2026-67578

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
tsuyoshi_saito soy_calendar to 2.5.0 (exc)
tsuyoshi_saito soy_calendar 2.5.0
tsuyoshi_saito soy_gallery 2.1.0
tsuyoshi_saito soy_inquiry 2.11.0
tsuyoshi_saito soy_shop 2.15.0
tsuyoshi_saito soy_cms 3.25.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SOY Gallery has a cross-site scripting vulnerability that allows arbitrary scripts to execute in the browser of users logging into the product. This happens due to improper input sanitization, enabling attackers to inject malicious scripts.

Detection Guidance

To detect this XSS vulnerability in SOY Gallery, inspect web application logs for unusual script execution patterns or user inputs containing HTML/JavaScript tags. Check for unexpected redirects or pop-ups during login. Use browser developer tools to monitor network requests for suspicious payloads in parameters.

Impact Analysis

An attacker could steal session cookies, redirect users to malicious sites, or perform actions on behalf of logged-in users. This may lead to unauthorized data access or account compromise for users with login privileges.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized data access or processing. For HIPAA, it may risk exposing protected health information. Compliance requires addressing XSS to protect user data and maintain security controls.

Mitigation Strategies

Update SOY Gallery to the latest version to patch the XSS vulnerability. Review and restrict user input handling in login pages to prevent script execution. Implement Content Security Policy (CSP) headers to mitigate XSS risks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78238. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart