PT-2026-55765

CVE-2026-14704

Published

2026-07-05

Updated

2026-07-05

Description by

CVSS 2.0

5.0

Medium

MetricsAV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions stephen-kruger bluebox versions prior to 4.5.13

Description An issue exists in an unknown functionality where manipulating the code argument allows for cross-site scripting (XSS), a technique used to inject malicious scripts into web pages viewed by other users. This attack can be initiated remotely.

Recommendations Update stephen-kruger bluebox to version 4.5.13 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Chor4O

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

CWE-94: Improper Control of Generation of Code (\'Code Injection\')