What’s Vulnerable › Vulnerabilities

CVE-2026-45231: DumbAssets 1.0.11 Stored Cross-Site Scripting via Asset Fields

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-18 · updated 2026-10-26
• Weakness: CWE-79

Description

DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, description, modelNumber, serialNumber, and tags that are stored without server-side sanitization and rendered using innerHTML without client-side escaping. Attackers can create or update assets with HTML or JavaScript payloads via the asset API endpoints to execute arbitrary scripts in the browsers of users viewing the asset list, and with Content-Security-Policy disabled, the injected scripts can make unrestricted connections to internal network services.

Affected products

• DumbWareio DumbAssets: through 1.0.11

References

• https://github.com/DumbWareio/DumbAssets/pull/135
• https://www.vulncheck.com/advisories/dumbassets-stored-cross-site-scripting-via-asset-fields

Get alerted when CVE-2026-45231 or the next vulnerability affects your stack