CVE-2026-75626

CRITICAL 9.3

SpiderFoot Stored Cross-Site Scripting via Correlation Titles

CVSS Score

9.3

EPSS Score

0.0%

EPSS Percentile

0th

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.

CWE	CWE-79
Vendor	smicallef
Product	spiderfoot
Published	Aug 18, 2026
Last Updated	Aug 18, 2026

Stay Ahead of the Next One

Get instant alerts for smicallef spiderfoot

Be the first to know when new critical vulnerabilities affecting smicallef spiderfoot are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

smicallef / spiderfoot

0 ≤ 4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/smicallef/spiderfoot/issues/2012 github.com: https://github.com/smicallef/spiderfoot github.com: https://github.com/smicallef/spiderfoot/blob/master/spiderfoot/correlation.py vulncheck.com: https://www.vulncheck.com/advisories/spiderfoot-stored-cross-site-scripting-via-correlation-titles

Credits

🔍 George Chen