Vulnerability · Published May 18, 2026 · Assigned by VulnCheck

CVE-2026-45231DumbAssets 1.0.11 Stored Cross-Site Scripting via Asset Fields

Medium 6.1

In plain English

A medium-severity cross-site scripting in DumbAssets from DumbWareio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 91.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, description, modelNumber, serialNumber, and tags that are stored without server-side sanitization and rendered using innerHTML without client-side escaping. Attackers can create or update assets with HTML or JavaScript payloads via the asset API endpoints to execute arbitrary scripts in the browsers of users viewing the asset list, and with Content-Security-Policy disabled, the injected scripts can make unrestricted connections to internal network services.

Affected products (as reported)

Vendor	Product	Versions
DumbWareio	DumbAssets	0 – through 1.0.11

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/DumbWareio/DumbAssets/pull/135 issue-tracking
https://www.vulncheck.com/advisories/dumbassets-stored-cross-site-scripting-via-asset-fields third-party-advisory