Read the docs
TI-2026-12895 Aliases CVE-2026-15321GHSA-4qw7-r7cw-fwf5

MyEMS Admin Backend svg.py on_post cross site scripting

Priority MEDIUM 55CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting, Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.

Summary

A vulnerability was found in MyEMS up to 6.4.0. The affected element is the function on_post of the file myems-api/core/svg.py of the component Admin Backend. The manipulation of the argument new_values['data'] results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 6.5.0 is sufficient to fix this issue. The patch is identified as 4a97edfbd786c779d0322054833b21ddf54d5b06. It is suggested to upgrade the affected component. The issue report remains open even though there is an official fix for it.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00385 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed MyEMS: 6.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—MyEMS6.0; 6.1; 6.2; 6.3; 6.4.06.5.0Patch availableCNA
  • MyEMS Vendor— Affected 6.0; 6.1; 6.2; 6.3; 6.4.0 Fixed in 6.5.0 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:myems:myems:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:myems:myems:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA MyEMS Fixed in 6.5.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15321
  2. 2026-10-03 Alias added: GHSA-4qw7-r7cw-fwf5

References

Exploit 1

Patch 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences