OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-93505

LOW · CVSS 3.5 EPSS 0.35% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-18 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

A cross-site scripting vulnerability exists in the SVG Media Upload component of SveltyCMS 0.0.6, specifically within the media-service.server.ts file. This flaw allows remote attackers to manipulate content, potentially leading to unauthorized script execution in users' browsers. Organizations using this CMS should prioritize applying the provided patch to mitigate the risk of exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-93505
Severity
LOW
CVSS
3.5
EPSS
0.35%

Original NVD Description

A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The patch is named 05b4f9efeb79e9d72a693232334d7529687f896f. Applying a patch is the recommended action to fix this issue.