CVE-2026-129267

LOW 3.5

sergix44 XBackBone MediaController.php getRawById cross site scripting

CVSS Score

3.5

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in sergix44 XBackBone up to 3.8.2. Impacted is the function MediaController::getRawById of the file app/Controllers/MediaController.php. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

CWE	CWE-79 CWE-94
Vendor	sergix44
Product	xbackbone
Published	Nov 14, 2026

Stay Ahead of the Next One

Get instant alerts for sergix44 xbackbone

Be the first to know when new low vulnerabilities affecting sergix44 xbackbone are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

sergix44 / XBackBone

3.8.0 3.8.1 3.8.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/437311 vuldb.com: https://vuldb.com/vuln/437311/cti vuldb.com: https://vuldb.com/cve/CVE-2026-129267 vuldb.com: https://vuldb.com/submit/1043413 github.com: https://github.com/sergix44/xbackbone/pull/673 github.com: https://github.com/sergix44/xbackbone/

Credits

🔍 joshyuan (VulDB User) VulDB CNA Team