Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Spina CMS 2.21.0 lets logged‑in users run unwanted scripts

CVE-2026-117182 · published 5 days ago
Summary

The Spina CMS version 2.21.0 component that handles embedded content can be tricked by a logged‑in user into inserting a specially crafted URL. This allows the attacker’s code to run in the browser of anyone who views the affected page, potentially stealing data or changing what is displayed. Apply the vendor’s update or patch and restrict who can add embedded URLs until the fix is installed.

Original advisory text
An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafte...
An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted URL.
References
Exploitation
<1% chance of attack within 30 days
Timeline
Published30 Oct 2026
Updated4 Nov 2026
First seen30 Oct 2026
Sources
CVE-2026-117182 · NVD
CVE-2026-117182 · MITRE
Track software like this
Free during beta