CVE-2026-7429 - SSCMS v7.4.0 Reflected Cross-Site Scripting via STL Processing

Back Back to CVE browser

LOW

SSCMS v7.4.0 Reflected Cross-Site Scripting via STL Processing

Published Apr 30, 2026

2.1

LOW

CVSS 4.0

EPSS 0.29%

Description

SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by crafting malicious STL template payloads that are decrypted and returned without proper sanitization. Attackers can exploit improper output encoding in the /api/stl/actions/dynamic endpoint to inject executable JavaScript into JSON responses, leading to session hijacking, phishing attacks, and unauthorized actions performed on behalf of users.

Affected products

Vendor Siteserver Product Sscms Default
n/a
- Version
  7.4.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Siteserver

Sscms

n/a

Version	Status	Constraints
7.4.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://github.com/siteserver/cms
product
https://github.com/siteserver/cms/issues/3892
exploitissue-tracking
https://www.vulncheck.com/advisories/sscms-reflected-cross-site-scripting-via-stl-processing
third-party-advisory

Link	Providers	Tags
https://github.com/siteserver/cms		product
https://github.com/siteserver/cms/issues/3892		exploitissue-tracking
https://www.vulncheck.com/advisories/sscms-reflected-cross-site-scripting-via-stl-processing		third-party-advisory