CVE-2026-90502
Received Received - Intake

Cross-Site Scripting in ServerStatus Stats Generation

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the component Stats Generation. Performing a manipulation of the argument custom results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90502
EUVD
EUVD-2026-76975

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
stilleshan serverstatus 1.0
stilleshan serverstatus 2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in stilleshan ServerStatus versions 1.0 and 2.0. It exists in the Stats Generation component of the server/src/main.cpp file. An attacker can manipulate the 'custom' argument to inject malicious scripts, which are then executed in the context of a user's browser.

Impact Analysis

This XSS vulnerability allows remote attackers to execute arbitrary scripts in a victim's browser when they access a crafted page. This could lead to theft of session cookies, account takeover, or defacement of the affected website. The exploit is publicly available, increasing the risk of real-world attacks.

Compliance Impact

This vulnerability involves a cross-site scripting (XSS) flaw in stilleshan ServerStatus, which could allow remote attackers to inject malicious scripts. Such vulnerabilities may lead to unauthorized data access or manipulation, potentially violating GDPR (data protection) and HIPAA (health data privacy) compliance if exploited.

Mitigation Strategies

Immediately update or patch the stilleshan ServerStatus software to the latest version. If no patch is available, consider disabling the Stats Generation component or restricting access to the server via network controls. Monitor network traffic for unusual activity related to cross-site scripting attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90502. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart