{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-29969", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-30T14:56:27.205Z", "dateReserved": "2026-03-04T00:00:00.000Z", "datePublished": "2026-03-26T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-26T19:05:41.349Z"}, "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability in the wff_cols_pref.css.aspx endpoint of staffwiki v7.0.1.19219 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted HTTP request."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/cmoncrook/Security-Advisories/blob/main/cve-2026-29969"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-30T13:53:33.618281Z", "id": "CVE-2026-29969", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T14:56:27.205Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-29969", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T13:53:33.618281Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T13:53:50.388Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/cmoncrook/Security-Advisories/blob/main/cve-2026-29969"}], "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability in the wff_cols_pref.css.aspx endpoint of staffwiki v7.0.1.19219 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted HTTP request."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-26T19:05:41.349Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29969", "state": "PUBLISHED", "dateUpdated": "2026-03-30T14:56:27.205Z", "dateReserved": "2026-03-04T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-26T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:workflowfirst:staffwiki:7.0.1.19219:*:*:*:*:*:*:*", "matchCriteriaId": "AA34861E-1A78-4E0F-A6BE-BEF18158DC46", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability in the wff_cols_pref.css.aspx endpoint of staffwiki v7.0.1.19219 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted HTTP request."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) en el endpoint wff_cols_pref.css.aspx de staffwiki v7.0.1.19219 permite a los atacantes ejecutar Javascript arbitrario en el contexto del navegador del usuario a trav\u00e9s de una solicitud HTTP manipulada."}], "id": "CVE-2026-29969", "lastModified": "2026-05-07T18:57:08.240", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-03-26T19:16:59.600", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/cmoncrook/Security-Advisories/blob/main/cve-2026-29969"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0.1.19219"}}], "enrichment": {"confidence": 75.0, "confidence_source": "inferred", "scores": [{"score": 75.0, "source": "inferred"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "staffwiki", "vendor": "cmoncrook"}], "analysis": {"en": {"generated_at": "2026-03-30T16:28:12.851043+00:00", "value": {"mitigation_remediation": ["Check the vendor\u2019s website or support channels for a security patch or newer release of Staffwiki that addresses the XSS flaw.", "If an official fix is not available, avoid exposing the wff_cols_pref.css.aspx endpoint to unauthenticated users or remove the endpoint if it is not required for functionality.", "Implement a Content Security Policy that restricts inline scripts and disallows unsafe-eval to mitigate the impact of any potential script injection.", "Consider applying input sanitization or escape mechanisms in any code that renders user-controlled data to the wff_cols_pref.css.aspx page, if custom development is possible."], "summary": {"action": "Patch", "impact": "Cross\u2011Site Scripting that enables arbitrary JavaScript execution in user browsers"}, "threat_synthesis": {"affected_systems": "The affected product is Staffwiki, version 7.0.1.19219. No additional vendor or product data was supplied by the CNA, and no other impacted versions are listed. Users of this specific Staffwiki build should verify whether they are running this vulnerable version.", "description_and_impact": "A vulnerability in Staffwiki v7.0.1.19219 allows an attacker to inject JavaScript code through a crafted HTTP request to the wff_cols_pref.css.aspx endpoint. When a victim\u2019s browser processes the response, the malicious script runs with the user\u2019s privileges, potentially leaking credentials, session cookies, or other sensitive data. The weakness is a classic XSS flaw (CWE\u201179).", "risk_and_exploitability": "The CVSS base score of 6.1 indicates a medium severity. EPSS scores below 1% suggest the vulnerability has a low probability of exploitation in the near term, and it is not currently documented in the CISA KEV catalog. Nevertheless, the attack vector is remote; an attacker can trigger the flaw by sending a crafted HTTP request, making the vulnerability accessible over the network without prior authentication or local access. Because it executes in the victim\u2019s browser, the impact can range from credential theft to full session hijacking, depending on what information the compromised context can reach."}}}}, "created": "2026-03-27T08:36:25.838319+00:00", "updated": "2026-03-30T20:57:50.233840+00:00", "vendors": ["cmoncrook", "cmoncrook$PRODUCT$staffwiki"]}