CVE-2026-14704

MEDIUM 4.3

stephen-kruger bluebox cross site scripting

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in stephen-kruger bluebox up to 4.5.12. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the argument code results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report.

CWE	CWE-79 CWE-94
Vendor	stephen-kruger
Product	bluebox
Published	Jul 5, 2026

Stay Ahead of the Next One

Get instant alerts for stephen-kruger bluebox

Be the first to know when new medium vulnerabilities affecting stephen-kruger bluebox are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

stephen-kruger / bluebox

4.5.0 4.5.1 4.5.2 4.5.3 4.5.4 4.5.5 4.5.6 4.5.7 4.5.8 4.5.9 4.5.10 4.5.11 4.5.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/376300 vuldb.com: https://vuldb.com/vuln/376300/cti vuldb.com: https://vuldb.com/cve/CVE-2026-14704 vuldb.com: https://vuldb.com/submit/847357 github.com: https://github.com/stephen-kruger/bluebox/issues/32 github.com: https://github.com/stephen-kruger/bluebox/issues/32#issuecomment-4632135192 github.com: https://github.com/stephen-kruger/bluebox/

Credits

🔍 chor4o (VulDB User) VulDB CNA Team