CVE-2026-12202
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Vulnerability in Intelliants Subrion CMS up to version 4.0.3. An unknown functionality of the Blocks Endpoint component allows XSS via manipulation of the CSS class name argument. The attack can be performed remotely.
Risk Assessment
The risk is the possibility of injecting malicious scripts, which could lead to session theft or website defacement.
Recommendation
It is recommended to update Subrion CMS to the latest version or apply available security patches.
Original NVD description (English source)
A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3. Affected by this issue is some unknown functionality of the component Blocks Endpoint. Such manipulation of the argument CSS class name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.