CVE-2026-129259

LOW 3.5

Mereithhh VanBlog Image Upload Endpoint access.ts cross site scripting

CVSS Score

3.5

EPSS Score

0.0%

EPSS Percentile

0th

A weakness has been identified in Mereithhh VanBlog up to 0.54.0. This affects an unknown part of the file packages/server/src/types/access/access.ts of the component Image Upload Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-79 CWE-94
Vendor	mereithhh
Product	vanblog
Published	Nov 14, 2026

Stay Ahead of the Next One

Get instant alerts for mereithhh vanblog

Be the first to know when new low vulnerabilities affecting mereithhh vanblog are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Mereithhh / VanBlog

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 0.10 0.11 0.12 0.13 0.14 0.15 0.16 0.17 0.18 0.19 0.20 0.21 0.22 0.23 0.24 0.25 0.26 0.27 0.28 0.29 0.30 0.31 0.32 0.33 0.34 0.35 0.36 0.37 0.38 0.39 0.40 0.41 0.42 0.43 0.44 0.45 0.46 0.47 0.48 0.49 0.50 0.51 0.52 0.53 0.54.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/437297 vuldb.com: https://vuldb.com/vuln/437297/cti vuldb.com: https://vuldb.com/cve/CVE-2026-129259 vuldb.com: https://vuldb.com/submit/1043136 note.geronimo.xin: http://note.geronimo.xin/post/70

Credits

🔍 Geronimo (VulDB User) VulDB CNA Team