IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-06-09 09:16

MODIFIED

2026-06-09 09:16

EPSS (Prob. Exploit)

0.52%

Top 56.6%

DATA SOURCES:

NVD 🔗 2026-06-09 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-29

> DESCRIPTION

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. User-supplied content was included in notification emails without proper escaping, allowing authenticated users to inject arbitrary HTML into emails sent to other users. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-80

> CWE DETAILED DESCRIPTIONS

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page - The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

> GITHUB SECURITY ADVISORY

GHSA-6qwm-5fm9-cvjx MODERATE

Apache Answer vulnerable to Cross-site Scripting

AFFECTED PACKAGES:

GO / github.com/apache/incubator-answer

< 1.7.2-0.20260509080709-d1a4092c61cc

Fixed in: 1.7.2-0.20260509080709-d1a4092c61cc

> HISTORIQUE DES MODIFICATIONS

Première apparition

09/06/2026 09:16

Source: NVD

📊 ENRICHISSEMENT 01/11/2026 06:59

CWE

Champ modifié: Description CWE

Ancienne valeur:

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) - The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes spe...

Nouvelle valeur:

📊 ENRICHISSEMENT 01/07/2026 06:01

CWE