Chargemap Web Platform: Stored cross-site scripting in user profile page
Summary
Chargemap contains a stored cross-site scripting (XSS) vulnerability in the user profile page. An authenticated attacker can store a malicious payload in their profile, which runs in the browser of another user who views that profile. Successful exploitation could allow actions in the victim's session, manipulation of displayed content, or phishing within the trusted application, with confidentiality and integrity impact.
Affected
- Chargemap Web Platform, versions before the security fix of 2026-07-17 (no version number published)
Fixed in
- Fix applied by the vendor on 2026-07-17 (no version number published)
Workaround
- Unknown.
Exploitation
- Not known to be exploited in the wild (not listed in the CISA KEV catalog).
- CISA SSVC data lists exploitation as 'poc' (proof of concept exists); public exploit code is not confirmed.
- Sources conflict on public exploit status; the referenced GitHub repository was not verified.
Our recommendation
- Ask Chargemap to confirm the fixed version and whether the fix applies to your tenant or installation.
- If you use Chargemap, check which staff or customer accounts exist and restrict profile-page access where possible.
- Verify that the vendor fix is active and monitor vendor communications.
- Re-check the CISA CSAF advisory and the GitHub repository once they are readable.
- Confirm whether the platform is vendor-hosted or self-hosted, as this determines responsibility for patching.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
praksokchea/CVE-2026-67175
Research sources
- CVE Record CVE-2026-67175 www.cve.org
- CISA CSAF advisory va-26-313-02 raw.githubusercontent.com
- GitHub repository praksokchea/CVE-2026-67175 github.com
- OpenCVE CVE-2026-67175 app.opencve.io
- OffSeq Radar CVE-2026-67175 radar.offseq.com
- TheHackerWire CVE-2026-67175 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:05.
Original description (NVD)
Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a malicious payload in the user profile page that executes when another user views the attacker's profile. Fixed 2026-07-17.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.