CVE-2026-14704 | A vulnerability was found in stephen-kruger bluebox up to 4.… | CVSS 4.3 MEDIUM

Description

A vulnerability was found in stephen-kruger bluebox up to 4.5.12. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the argument code results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report.

Metadata

CVE ID: CVE-2026-14704
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-04 05:46 UTC
Published: 2026-07-05 04:30 UTC
Last updated: 2026-07-05 04:30 UTC
Primary CWE: CWE-79
Cross Site Scripting
Vendor / Product: stephen-kruger / bluebox
Sources: cve.org · NVD

Severity & Metrics

4.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

Affected products (1)

Vendor	Product	Platform	Versions
stephen-kruger	bluebox	—	4.5.0, 4.5.1, 4.5.2, 4.5.3 …

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	Cross Site Scripting
CWE-94	cna	Code Injection

CVSS scores (4)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
5.0	N/D	2.0	cna	AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR
4.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
4.3	MEDIUM	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References (7)

VDB-376300 | stephen-kruger bluebox cross site scripting https://vuldb.com/vuln/376300
VDB-376300 | CTI Indicators (IOB, IOC, TTP, IOA) https://vuldb.com/vuln/376300/cti
CVE-2026-14704 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-14704
Submit #847357 | Bluebox BlueBox V4.5.12 Cross Site Scripting https://vuldb.com/submit/847357
https://github.com/stephen-kruger/bluebox/issues/32
https://github.com/stephen-kruger/bluebox/issues/32#issuecomment-4632135192
https://github.com/stephen-kruger/bluebox/