XSS in Facilemanager
CVE-2026-30919
facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , stored XSS (also known as persistent or second-order XSS) occurs when an application receives data from an untrusted source and includes that data in its subsequent HTTP responses in an unsafe manner. This vulnerability was found in the fmDNS module. This vulnerability is fixed in 6.0.4.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L.
EPSS exploit prediction
EPSS: 0.003 (18.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 18.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001
Affected products
- Facilemanager — versions 5.4.4
Weakness classification (CWE)
References
- github.com/facileManager/facileManager/security/advisories/GHSA-2339-h9qw-q6vf (Exploit, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-30919?
- CVE-2026-30919 is a high-severity vulnerability in Facilemanager, classified under Cross-site Scripting. CVSS score: 7.6/10. Published 2026-03-10.
- How severe is CVE-2026-30919?
- High severity. CVSS v3 base score is 7.6 out of 10.