PT-2026-29448

CVE-2026-5253

Published

2026-04-01

Updated

2026-04-01

Description by

CVSS 2.0

4.0

Medium

MetricsAV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions bufanyun HotGo versions 1.0 through 2.0

Description A weakness exists in bufanyun HotGo versions 1.0 and 2.0. The issue affects an unknown functionality within the /web/src/layout/components/Header/MessageList.vue file of the editNotice endpoint component. Manipulating this functionality can lead to cross site scripting (XSS). The attack can be launched remotely, and an exploit is publicly available. The vendor was contacted regarding this disclosure but did not respond.

Recommendations For versions 1.0 and 2.0, address the vulnerability in the /web/src/layout/components/Header/MessageList.vue file of the editNotice endpoint component to prevent cross site scripting.

Exploitability

Exploit

Fix

Impacts

Researchers

Vuldb

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers