CVE-2026-8080

medium

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS.

Vendor / product: Misp-project — misp

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS. This issue affects MISP before 2.5.37. A stored cross-site scripting vulnerability exists in the template element attribute handling logic. The application accepted arbitrary values for the TemplateElementAttribute type and category fields without validating them against the known MISP attribute type and category definitions. An attacker with permission to create or modify template element attributes could store a crafted type value. This affects the old templating (not more accessible in 2.5.37) engine from MISP which will be removed in 2.5.38

CVSS

5.4

5.4 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-05-07 12:16

Modified: 2026-11-11 23:10

NVD status: Analyzed

Last synced 3 hours ago

Verified against the source API 2026-11-11 23:13 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

misp-project / misp <2.5.37

Weakness classification (CWE)

CWE-79

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Patch / mitigation: https://github.com/MISP/MISP/commit/62824e5ca0056d01b195f70466ea0d382cca06d0

References

https://github.com/MISP/MISP/commit/62824e5ca0056d01b195f70466ea0d382cca06d0 5a6e4751-2f3f-4070-9419-94fb35b644e8

Data sources

NVD CVE API 2.0 — fetched 2026-11-11 23:13 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-8080

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs