CVE-2026-30918
Published: 10 March 2026
Summary
CVE-2026-30918 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Facilemanager Facilemanager. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-30918 is a reflected cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting facileManager versions prior to 6.0.4. FacileManager is a modular suite of web applications designed for system administrators. The flaw resides in the fmDNS module, where the log_search_query parameter fails to properly sanitize user input, allowing malicious JavaScript code to be injected via a crafted URL and reflected in HTTP responses.
Exploitation requires an attacker to have low privileges (PR:L) and involves tricking a victim into interacting with a malicious URL (UI:R), such as by clicking a link. The attack is network-accessible (AV:N) with low complexity (AC:L) and no scope change (S:U). Successful exploitation executes arbitrary JavaScript in the victim's browser, yielding high confidentiality and integrity impacts (C:H/I:H) alongside low availability impact (A:L), as scored at 7.6 under CVSS v3.1.
The vulnerability is fixed in facileManager 6.0.4. Additional mitigation details are available in the GitHub security advisory at https://github.com/facileManager/facileManager/security/advisories/GHSA-284f-mff7-744x.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10428
Vulnerability details
facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , a reflected XSS occurs when an application receives data from an untrusted source and uses it in its HTTP responses in a…
more
way that could lead to vulnerabilities. It is possible to inject malicious JavaScript code into a URL by adding a script in a parameter. This vulnerability was found in the fmDNS module. The parameter that is vulnerable to an XSS attack is log_search_query. This vulnerability is fixed in 6.0.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing fmDNS web module enables direct exploitation of the app (T1190) to deliver/execute arbitrary JS payloads (T1059.007) via malicious links (T1566.002) that hijack browser sessions (T1185).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates validating information inputs such as the log_search_query parameter to block malicious JavaScript injection in the fmDNS module.
SI-15 requires filtering HTTP response outputs to encode or sanitize reflected user input, preventing execution of injected JavaScript in victims' browsers.
SI-2 ensures timely flaw remediation by applying patches like the facileManager 6.0.4 update that fixes the reflected XSS vulnerability.