CVE-2026-14704
Full vulnerability record from the local CVENow database.
Description
A vulnerability was found in stephen-kruger bluebox up to 4.5.12. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the argument code results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report.
Severity
LOW
CVSS score
2.1
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-07-05 06:16:28.420000
Last modified
2026-10-25 15:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-14704",
"sourceIdentifier": "[email protected]",
"published": "2026-07-05T06:16:28.420",
"lastModified": "2026-10-25T15:10:00.147",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in stephen-kruger bluebox up to 4.5.12. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the argument code results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report."
},
{
"lang": "es",
"value": "Se encontró una vulnerabilidad en stephen-kruger bluebox hasta la versión 4.5.12. Afectada por esta vulnerabilidad es una funcionalidad desconocida. Realizar una manipulación del código del argumento resulta en cross site scripting. Es posible iniciar el ataque remotamente. El exploit se ha hecho público y podría ser utilizado. El proyecto fue informado del problema tempranamente a través de un informe de incidencias."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "stephen-kruger",
"product": "bluebox",
"cpes": [
"cpe:2.3:a:stephen-kruger:bluebox:*:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "4.5.0",
"status": "affected"
},
{
"version": "4.5.1",
"status": "affected"
},
{
"version": "4.5.2",
"status": "affected"
},
{
"version": "4.5.3",
"status": "affected"
},
{
"version": "4.5.4",
"status": "affected"
},
{
"version": "4.5.5",
"status": "affected"
},
{
"version": "4.5.6",
"status": "affected"
},
{
"version": "4.5.7",
"status": "affected"
},
{
"version": "4.5.8",
"status": "affected"
},
{
"version": "4.5.9",
"status": "affected"
},
{
"version": "4.5.10",
"status": "affected"
},
{
"version": "4.5.11",
"status": "affected"
},
{
"version": "4.5.12",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.1,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"baseScore": 5.0,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"availabilityImpact": "NONE"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-06T16:45:58.381589Z",
"id": "CVE-2026-14704",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
},
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"references": [
{
"url": "https://github.com/stephen-kruger/bluebox/",
"source": "[email protected]"
},
{
"url": "https://github.com/stephen-kruger/bluebox/issues/32",
"source": "[email protected]"
},
{
"url": "https://github.com/stephen-kruger/bluebox/issues/32#issuecomment-4632135192",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-14704",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/847357",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/376300",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/376300/cti",
"source": "[email protected]"
}
]
}