CVE-2026-14704

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-14704

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14704.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-14704

Published

2026-07-05T04:30:08.009Z

Modified

2026-07-15T01:49:12.176947863Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

stephen-kruger bluebox cross site scripting

Details

A vulnerability was found in stephen-kruger bluebox up to 4.5.12. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the argument code results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report.

Database specific

{
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.5.0"
                },
                {
                    "last_affected": "4.5.0"
                },
                {
                    "introduced": "4.5.1"
                },
                {
                    "last_affected": "4.5.1"
                },
                {
                    "introduced": "4.5.4"
                },
                {
                    "last_affected": "4.5.4"
                },
                {
                    "introduced": "4.5.5"
                },
                {
                    "last_affected": "4.5.5"
                },
                {
                    "introduced": "4.5.6"
                },
                {
                    "last_affected": "4.5.6"
                },
                {
                    "introduced": "4.5.7"
                },
                {
                    "last_affected": "4.5.7"
                },
                {
                    "introduced": "4.5.8"
                },
                {
                    "last_affected": "4.5.8"
                },
                {
                    "introduced": "4.5.10"
                },
                {
                    "last_affected": "4.5.10"
                },
                {
                    "introduced": "4.5.11"
                },
                {
                    "last_affected": "4.5.11"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14704.json",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ]
}

References

Affected packages

Git / github.com/stephen-kruger/bluebox

Affected ranges

Type

GIT

Repo

https://github.com/stephen-kruger/bluebox

Events

Introduced

87eb8fb8d2c7bd1d2ec0695be557b7598db2cb3e

Last affected

2460630129d4b4c92e5fe829b6573d7455756c30

Database specific

{
    "extracted_events": [
        {
            "introduced": "4.5.2"
        },
        {
            "last_affected": "4.5.2"
        },
        {
            "introduced": "4.5.3"
        },
        {
            "last_affected": "4.5.3"
        },
        {
            "introduced": "4.5.9"
        },
        {
            "last_affected": "4.5.9"
        },
        {
            "introduced": "4.5.12"
        },
        {
            "last_affected": "4.5.12"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

4.*

4.5.12

4.5.2

4.5.3

4.5.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14704.json"