Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the…
Affects MyBeeHome web application versions before 2025-11-01 in Cloud/SaaS deployments. The checked facts give no vendor rating and no fixed version.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
BeeHome MyBeeHome, prior to its 2025-11-01 update, is affected by a cross-site scripting flaw. A remote attacker could exploit it through the profile editing and chat messaging features to run malicious code in users' browsers.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile editing functionality, chat messaging component.
Timeline
- CVE published
- Record last updated
- First seen by cve.now
Affected versions
No affected packages have been listed by the sources.
References 1
GitHub · jhonny606/mybeehome-stored-xss-2025
Questions about CVE-2026-37468
What does this mean?
An authenticated attacker can run arbitrary JavaScript in the browsers of other authenticated users. This can enable session hijacking, account takeover, unauthorized actions as the victim, or exposure of sensitive user information.Source: github.com
Am I affected, and how do I check?
The affected versions are MyBeeHome Web Application versions before 2025-11-01, in a Cloud / SaaS deployment. To check an installed version, compare its release date with 2025-11-01.Source: github.com
What should I do about it?
The checked facts name no fixed release or upgrade target. The vendor's advisory or update notice should be consulted for the version that addresses this issue.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The checked facts describe no workaround. No mitigation short of a vendor update is documented in the sources provided.Source: github.com