CVE-2026-12202: Subrion CMS vulnerable to Cross-site Scripting

June 15, 2026 (updated August 25, 2026)

A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3. Affected by this issue is some unknown functionality of the component Blocks Endpoint. Such manipulation of the argument CSS class name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

github.com/advisories/GHSA-wrcg-234w-hfhq
hackmd.io/@noka/B1sue5Xkzl
karinagante.github.io/cve-2026-12202
karinagante.github.io/cve-2026-12202/
nvd.nist.gov/vuln/detail/CVE-2026-12202
vuldb.com/cve/CVE-2026-12202
vuldb.com/submit/830013
vuldb.com/vuln/370845
vuldb.com/vuln/370845/cti

Code Behaviors & Features

Detect and mitigate CVE-2026-12202 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →