CVE-2026-15321

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15321

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15321.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15321

Published

2026-07-10T02:45:09.559Z

Modified

2026-07-15T01:48:54.533140091Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

MyEMS Admin Backend svg.py on_post cross site scripting

Details

A vulnerability was found in MyEMS up to 6.4.0. The affected element is the function onpost of the file myems-api/core/svg.py of the component Admin Backend. The manipulation of the argument newvalues['data'] results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 6.5.0 is sufficient to fix this issue. The patch is identified as 4a97edfbd786c779d0322054833b21ddf54d5b06. It is suggested to upgrade the affected component. The issue report remains open even though there is an official fix for it.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15321.json",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "6.0"
                },
                {
                    "last_affected": "6.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/myems/myems

Affected ranges

Type

GIT

Repo

https://github.com/myems/myems

Events

Introduced

4c373bdc1337886c7f1c2e33fd94b680ea44cbf5

Fixed

4a97edfbd786c779d0322054833b21ddf54d5b06

Fixed

df3a2183d8fa47fb517214616570098fb0632ac8

Database specific

{
    "extracted_events": [
        {
            "introduced": "6.1"
        },
        {
            "last_affected": "6.1"
        },
        {
            "introduced": "6.2"
        },
        {
            "last_affected": "6.2"
        },
        {
            "introduced": "6.3"
        },
        {
            "last_affected": "6.3"
        },
        {
            "introduced": "6.4.0"
        },
        {
            "last_affected": "6.4.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

6.*

6.1

6.2

6.3

6.4.0

v6.*

v6.1.0

v6.2.0

v6.3.0

v6.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15321.json"