PT-2026-49163

CVE-2026-12202

Published

2026-06-15

Updated

2026-06-15

Description by

CVSS 2.0

3.3

Low

MetricsAV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS versions prior to 4.0.4

Description Cross site scripting is possible via the Blocks Endpoint. Remote attackers can exploit this by manipulating the CSS class name argument. Cross site scripting is a type of security flaw that allows attackers to inject malicious scripts into web pages viewed by other users.

Recommendations Update to a version newer than 4.0.3. As a temporary workaround, restrict access to the Blocks Endpoint to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Karina Gante

Karinagante

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')