CVE-2026-15928 - Vulnerability Details - OpenCVE

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Xmlrpc-c	Xmlrpc-c

No data.

No data.

References

Link	Providers
https://www.themissinglink.com.au/security-advisories/cve-2026-15928
https://xmlrpc-c.sourceforge.io/

History

Mon, 27 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 27 Jul 2026 13:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Xmlrpc-c Xmlrpc-c xmlrpc-c
Vendors & Products		Xmlrpc-c Xmlrpc-c xmlrpc-c

Mon, 27 Jul 2026 02:45:00 +0000

Type	Values Removed	Values Added
Description		XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.
Weaknesses		CWE-79
References		https://www.themissinglink.com.au/security-advisories/cve-2026-15928 https://xmlrpc-c.sourceforge.io/
Metrics		cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: TML

Published: 2026-07-27T02:23:23.674Z

Updated: 2026-07-27T14:53:06.306Z

Reserved: 2026-07-16T07:05:00.749Z

Link: CVE-2026-15928

Vulnrichment

Updated: 2026-07-27T14:52:30.304Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15928", "assignerOrgId": "07aac9b9-e3e9-4d03-a447-764bd31371d7", "state": "PUBLISHED", "assignerShortName": "TML", "dateReserved": "2026-07-16T07:05:00.749Z", "datePublished": "2026-07-27T02:23:23.674Z", "dateUpdated": "2026-07-27T14:53:06.306Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "07aac9b9-e3e9-4d03-a447-764bd31371d7", "shortName": "TML", "dateUpdated": "2026-07-27T02:23:23.674Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"vendor": "XMLRPC-C", "product": "XMLRPC-C", "repo": "https://sourceforge.net/p/xmlrpc-c/code/HEAD/tree/", "versions": [{"status": "affected", "version": "1.07", "lessThanOrEqual": "1.67.01", "versionType": "Advanced"}, {"status": "affected", "version": "1.07", "lessThanOrEqual": "1.64.03", "versionType": "Super stable"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component."}]}], "references": [{"url": "https://xmlrpc-c.sourceforge.io/", "tags": ["vendor-advisory"]}, {"url": "https://www.themissinglink.com.au/security-advisories/cve-2026-15928", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.2, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Andrew Bick at The Missing Link Security", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-27T14:52:18.651681Z", "id": "CVE-2026-15928", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T14:53:06.306Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15928", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T14:52:18.651681Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T14:52:30.304Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Andrew Bick at The Missing Link Security"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://sourceforge.net/p/xmlrpc-c/code/HEAD/tree/", "vendor": "XMLRPC-C", "product": "XMLRPC-C", "versions": [{"status": "affected", "version": "1.07", "versionType": "Advanced", "lessThanOrEqual": "1.67.01"}, {"status": "affected", "version": "1.07", "versionType": "Super stable", "lessThanOrEqual": "1.64.03"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://xmlrpc-c.sourceforge.io/", "tags": ["vendor-advisory"]}, {"url": "https://www.themissinglink.com.au/security-advisories/cve-2026-15928", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.", "supportingMedia": [{"type": "text/html", "value": "XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')"}]}], "providerMetadata": {"orgId": "07aac9b9-e3e9-4d03-a447-764bd31371d7", "shortName": "TML", "dateUpdated": "2026-07-27T02:23:23.674Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15928", "state": "PUBLISHED", "dateUpdated": "2026-07-27T14:53:06.306Z", "dateReserved": "2026-07-16T07:05:00.749Z", "assignerOrgId": "07aac9b9-e3e9-4d03-a447-764bd31371d7", "datePublished": "2026-07-27T02:23:23.674Z", "assignerShortName": "TML"}, "dataVersion": "5.2"}