CVE-2026-5015 - elecV2 elecV2P Endpoint logs cross site scripting

Back Back to CVE browser

MEDIUM

elecV2 elecV2P Endpoint logs cross site scripting

Published Mar 28, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.45%

Description

A vulnerability was determined in elecV2 elecV2P up to 3.8.3. The impacted element is an unknown function of the file /logs of the component Endpoint. This manipulation of the argument filename causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

Vendor elecV2 Product elecV2P Default
n/a
- Version
  3.8.0
  Status
  affected
  Constraints
  -
- Version
  3.8.1
  Status
  affected
  Constraints
  -
- Version
  3.8.2
  Status
  affected
  Constraints
  -
- Version
  3.8.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

elecV2

elecV2P

n/a

Version	Status	Constraints
3.8.0	affected	-
3.8.1	affected	-
3.8.2	affected	-
3.8.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-94

Code Injection

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-16949
Advisory
https://github.com/elecV2/elecV2P/
product
https://github.com/elecV2/elecV2P/issues/201
exploitissue-tracking
https://vuldb.com/submit/779180
third-party-advisory
https://vuldb.com/vuln/353900
vdb-entrytechnical-description
https://vuldb.com/vuln/353900/cti
signaturepermissions-required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-16949		Advisory
https://github.com/elecV2/elecV2P/		product
https://github.com/elecV2/elecV2P/issues/201		exploitissue-tracking
https://vuldb.com/submit/779180		third-party-advisory
https://vuldb.com/vuln/353900		vdb-entrytechnical-description
https://vuldb.com/vuln/353900/cti		signaturepermissions-required