Vulnerability · Published Jul 14, 2026 · Assigned by VulnCheck

CVE-2026-58475Sustainable Irrigation Platform 5.2.16 Stored XSS via Program Name

Medium 6.1

In plain English

A medium-severity cross-site scripting in SIP from Dan-in-CA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 75.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the lack of output encoding on rendered program names to execute arbitrary JavaScript in the browsers of any users viewing the affected page, with exploitation facilitated by the absence of a required passphrase or the default passphrase 'opendoor'.

Affected products (as reported)

Vendor	Product	Versions
Dan-in-CA	SIP	0 – through 5.2.16

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Zero Science Lab Advisory (ZSL-2026-5994) technical-description, exploit
https://www.vulncheck.com/advisories/sustainable-irrigation-platform-stored-xss-via-program-name third-party-advisory