Vulnerability · Published Jun 1, 2026 · Assigned by VulDB
CVE-2026-10234Mettle sendportal Campaign webview cross site scripting
Low 3.5
In plain English
A low-severity cross-site scripting in sendportal from Mettle. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Official description
A vulnerability was detected in Mettle sendportal up to 3.0.1. This affects an unknown part of the file /webview/ of the component Campaign Handler. The manipulation of the argument content results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mettle | sendportal | 3.0.03.0.1 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
References
- VDB-367513 | Mettle sendportal Campaign webview cross site scripting vdb-entry, technical-description
- VDB-367513 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-10234 | CVE Analysis and Report third-party-advisory
- Submit #822923 | Mettle sendportal v3.0.1 Cross Site Scripting third-party-advisory
- Submit #825494 | mettle sendportal 3.0.1 Cross Site Scripting (Duplicate) third-party-advisory
- https://github.com/mettle/sendportal/issues/338 exploit, issue-tracking
- https://github.com/mettle/sendportal/ product