Chargemap: Stored cross-site scripting in account registration
Summary
Chargemap contains a stored cross-site scripting (XSS) vulnerability. A remote, unauthenticated attacker can place a script payload in the username field of the registration page and link the account to a victim's email address. The attacker then triggers a forgotten-password request for the victim, and the payload runs in the victim's browser when the victim opens the link. The CVSS 4.0 score is 5.1 (Medium), and the record requires user interaction.
Affected
- Chargemap platform versions before 2026-07-17 (the vendor uses no version numbers in the record; the affected range is date-based)
Fixed in
- Fixed on 2026-07-17 according to the CVE record and third-party trackers. Vendor advisory not found.
Workaround
- None published. The fix is server-side, so customers depend on the vendor.
Exploitation
- Not listed in CISA KEV.
- Not known to be exploited in the wild (OffSeq tracker).
- Public proof-of-concept status is conflicting and unverified. Unknown.
Our recommendation
- Ask Chargemap in writing whether your tenant or the service runs the 2026-07-17 fix or a later build.
- Ask whether existing accounts were checked for malicious usernames.
- Warn staff that password-reset emails may lead to pages with injected scripts, and tell them to type the service address directly instead of clicking links.
- Monitor for unusual account activity and restrict access to fleet or charging accounts where possible.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
praksokchea/CVE-2026-67177
Research sources
- CVE record mirror (OpenCVE) app.opencve.io
- CVE record mirror with CVSS vector and dates (threatint) cve.threatint.com
- CISA CSAF advisory va-26-313-02 (not opened) raw.githubusercontent.com
- The Hacker Wire: CVE-2026-67177 www.thehackerwire.com
- OffSeq Radar: CVE-2026-67177 radar.offseq.com
- Strix AI: CVE-2026-67177 www.strix.ai
- Patrick Coyle newsletter (CISA coordination history) patrickcoyle.substack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:05.
Original description (NVD)
Chargemap contains a stored cross site scripting vulnerability. A remote, unauthenticated attacker could craft a payload in the username field of the account registration page and associate the new account with a victim's email. The attacker could send a forgotten password request to the victim, and the payload would execute when a victim opens the link. Fixed 2026-07-17.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.