Home

Description

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the lack of output encoding on rendered program names to execute arbitrary JavaScript in the browsers of any users viewing the affected page, with exploitation facilitated by the absence of a required passphrase or the default passphrase 'opendoor'.

PUBLISHED Reserved 2026-06-30 | Published 2026-07-14 | Updated 2026-07-14 | Assigner VulnCheck




MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

MEDIUM: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status
affected

Any version
affected

Credits

Anja Ivanovska of Zero Science Lab finder

References

www.zeroscience.mk/ (Zero Science Lab Advisory (ZSL-2026-5994)) technical-description exploit

www.vulncheck.com/...on-platform-stored-xss-via-program-name third-party-advisory

cve.org (CVE-2026-58475)

nvd.nist.gov (CVE-2026-58475)

Download JSON