Approved changes feed: RSS · Atom
cpe:2.3:a:kagisearch:smallweb:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Kagisearch (87e76c5e-33d1-5514-949a-bf1be7694720) |
|---|---|
| Product | Smallweb (54ef6728-7323-5932-8ec1-f7f4b8e4c2c3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-90583 |
vulnerable | 2026-09-16 04:33:05.396656 |
kagisearch smallweb Query String Rendering sw.py index cross site scripting
MEDIUM (4.3)
A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The patch is named 00b68144e583f20a6b67e29cf01bc07f57979ffb. It is recommended to apply a patch to fix this issue. Exploitability requires a raw HTTP request carrying unencoded double-quote characters in the query string - Werkzeug's request.query_string returns the raw request-target, and ordinary browsers percent-encode " as %22, so the payload only lands via netcat/curl-style raw sockets.
Published: 2026-09-13T20:00:09.772Z
Updated: 2026-09-15T17:58:22.697Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.