by Kastro
Paper/Archive/CVE-2026-75626

CVE-2026-75626

smicallef spiderfoot — SpiderFoot Stored Cross-Site Scripting via Correlation Titles

EPSS 0.3%public exploitCVSS 9.3
critical.is priorityof 100
43
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 26.3.263 × 205.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.

Affected

ProductAffectedFixed inSource
spiderfoot≤ 4.0–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
VulnCheck (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/smicallef/spiderfoot/issues/2012refgithub.com/smicallef/spiderfootwriteupgithub.com/smicallef/spiderfoot/blob/master/spiderfoot/correlation.pywriteupvulncheck.com/advisories/spiderfoot-stored-cross-site-scripting-via-correlation-titles