CVE-2026-58475 | Sustainable Irrigation Platform (SIP) through version 5.2.16… | CVSS 6.1 MEDIUM

Description

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the lack of output encoding on rendered program names to execute arbitrary JavaScript in the browsers of any users viewing the affected page, with exploitation facilitated by the absence of a required passphrase or the default passphrase 'opendoor'.

Metadata

CVE ID: CVE-2026-58475
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-06-30 20:20 UTC
Published: 2026-07-14 14:19 UTC
Last updated: 2026-07-15 14:46 UTC
Primary CWE: CWE-79
Improper Neutralization of Input During Web Page Generation …
Vendor / Product: Dan-in-CA / SIP
Sources: cve.org · NVD

Severity & Metrics

6.1 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Dan-in-CA	SIP	—	0 ≤ 5.2.16

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS scores (2)

Score	Severity	Version	Source	Vector
6.1	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References (2)

Zero Science Lab Advisory (ZSL-2026-5994) https://www.zeroscience.mk/#/advisories/ZSL-2026-5994
https://www.vulncheck.com/advisories/sustainable-irrigation-platform-stored-xss-via-program-name