SZB-0f54eeb27c
EUVD lists authenticated XSS in Spina CMS v2.21.0 (EUVD-2026-114177)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Spina
- Product
- Spina CMS
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-114177, as shared on Mastodon, describes an authenticated cross-site scripting flaw in the /spina/embeddable.rb component of Spina CMS v2.21.0. The entry has no CVSS score yet.
If you use Spina
Check whether you run Spina CMS v2.21.0.
Restrict CMS editor accounts to trusted users until a fix is released.
Watch the Spina project for a patched release.
What the sources say 1
· Mastodon: “An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted URL.” Source