{"id":"CVE-2025-26206","aliases":["EUVD-2025-5544","GHSA-r7pc-h4wr-xggx"],"status":"published","title":"Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker...","description":"Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component","severity":{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0062,"percentile":0.50181,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-352"],"published":"2025-03-03T00:00:00Z","modified":"2026-06-17T09:01:31Z","exploits":[{"source":"pocgithub","id":"xibhi/CVE-2025-26206","title":"xibhi/CVE-2025-26206","date":"2025-02-24","url":"https://github.com/xibhi/CVE-2025-26206"}],"products":[{"vendor":"selldone","product":"storefront"}],"references":[{"url":"https://github.com/selldone/storefront/blob/main/index.html","tags":["Exploit"]},{"url":"https://github.com/xibhi/CVE-2025-26206","tags":["Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26206"},{"url":"https://github.com/advisories/GHSA-r7pc-h4wr-xggx"}],"sources":{"cve":[{"id":"CVE-2025-26206","description":"Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component","status":"published","published":"2025-03-03T00:00:00Z","modified":"2025-03-04T16:51:38.101Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:28.250136Z"}],"euvd":[{"id":"EUVD-2025-5544","description":"Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component","status":"published","published":"2025-03-03T00:00:00Z","modified":"2025-03-04T16:51:38Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:16.995722Z"}],"ghsa":[{"id":"GHSA-r7pc-h4wr-xggx","title":"Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker...","description":"Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component","status":"published","published":"2025-03-03T21:30:59Z","modified":"2025-03-04T18:34:37Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:00:08.489328Z"}],"nvd":[{"id":"CVE-2025-26206","description":"Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component","status":"published","published":"2025-03-03T19:15:35.507Z","modified":"2026-06-17T09:01:31.47Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:10:52.398004Z"}]}}