CVE-2026-6179 - Vulnerability Details - OpenCVE

Stored Cross Site Scripting in NightWolf Penetration Testing Platform allows attack trigger and run malicious script in user's browser

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00047.

Key SSVC decision points have not yet been added.

Vendors	Products
Fpt Software	Nightwolf Penetration Testing Platform

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Fpt Software	Nightwolf Penetration Testing Platform

References

Link	Providers
https://bug.report.night-wolf.io/changelogs

History

Mon, 13 Apr 2026 13:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Fpt Software Fpt Software nightwolf Penetration Testing Platform
Vendors & Products		Fpt Software Fpt Software nightwolf Penetration Testing Platform

Mon, 13 Apr 2026 02:45:00 +0000

Type	Values Removed	Values Added
Description		Stored Cross Site Scripting in NightWolf Penetration Testing Platform allows attack trigger and run malicious script in user's browser
Title		Stored Cross Site Scripting in NightWolf Penetration Testing Platform
Weaknesses		CWE-79
References		https://bug.report.night-wolf.io/changelogs
Metrics		cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: FSOFT

Published: 2026-04-13T02:27:53.206Z

Updated: 2026-04-13T02:27:53.206Z

Reserved: 2026-04-13T02:18:11.562Z

Link: CVE-2026-6179

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-04-13T03:16:03.297

Modified: 2026-04-13T15:01:43.663

Link: CVE-2026-6179

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-13T12:53:39Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6179", "assignerOrgId": "5ac195ad-69e7-48e7-9c1e-bfc958c39761", "state": "PUBLISHED", "assignerShortName": "FSOFT", "dateReserved": "2026-04-13T02:18:11.562Z", "datePublished": "2026-04-13T02:27:53.206Z", "dateUpdated": "2026-04-13T02:27:53.206Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "5ac195ad-69e7-48e7-9c1e-bfc958c39761", "shortName": "FSOFT", "dateUpdated": "2026-04-13T02:27:53.206Z"}, "title": "Stored Cross Site Scripting in NightWolf Penetration Testing Platform", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "affected": [{"vendor": "FPT Software", "product": "NightWolf Penetration Testing Platform", "versions": [{"status": "affected", "version": "2.1.5"}, {"status": "unaffected", "version": "2.1.6"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Stored Cross Site Scripting in NightWolf Penetration Testing Platform allows attack trigger and run malicious script in user's browser", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Stored Cross Site Scripting in NightWolf Penetration Testing Platform allows attack trigger and run malicious script in user's browser"}]}], "references": [{"url": "https://bug.report.night-wolf.io/changelogs"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N"}}], "timeline": [{"time": "2026-04-11T10:00:00.000Z", "lang": "en", "value": "The reporter submits the vulnerability to security_report@fpt.com."}, {"time": "2026-04-12T11:00:00.000Z", "lang": "en", "value": "The security team verifies the issue and provides a fixing solution."}, {"time": "2026-04-13T01:00:00.000Z", "lang": "en", "value": "The security team releases the fix, retests the issue, and closes the vulnerability."}, {"time": "2026-04-13T02:00:00.000Z", "lang": "en", "value": "Assign a CVE to the reporter."}], "credits": [{"lang": "en", "value": "Phan Cong Anh Tuan (phanconganhtuan2003@gmail.com)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}}}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.1.6"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "NightWolf Penetration Testing Platform", "source": "cna", "vendor": "FPT Software"}, "product": "nightwolf_penetration_testing_platform", "vendor": "fpt_software"}], "analysis": {"en": {"generated_at": "2026-04-13T03:20:20.620322+00:00", "value": {"mitigation_remediation": ["Check the vendor\u2019s advisory page for a patch that addresses the stored XSS issue and apply it immediately.", "If a patch is not yet available, enforce strict input validation and output encoding for all fields that accept user data before rendering it in the browser.", "Restrict or revoke permissions for users who can create or modify data that appears on public or shared interfaces, thereby limiting the attack surface.", "Configure web application firewalls to detect and block common XSS payloads and monitor logs for signs of unexpected script execution or unauthorized data changes."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the NightWolf Penetration Testing Platform developed by FPT Software. The advisory does not list specific versions, so any deployment of the platform that accepts user input and subsequently displays that data to users is potentially impacted.", "description_and_impact": "The NightWolf Penetration Testing Platform is vulnerable to stored cross\u2011site scripting. This weakness allows an attacker to insert malicious script into data fields stored within the platform. When a legitimate user views the affected content, the script executes in the user's browser, enabling the attacker to steal session cookies, hijack user sessions, deface the interface, or perform other client\u2011side actions. The vulnerability results from unsanitized input leading to improper encoding of output.", "risk_and_exploitability": "The CVSS score of 6.3 indicates moderate severity, reflecting a medium base score that balances the likelihood of exploitation with the potential impact on confidentiality, integrity, and availability. Because an EPSS score is unavailable, the precise exploitation probability remains uncertain. The vulnerability is not cataloged in CISA\u2019s KEV list, suggesting no known active exploitation. The attack vector typically involves an attacker submitting malicious payload into a stored field; the attacker must possess sufficient privileges to create or edit that data, and subsequent users who view the data will become victims."}}}}, "created": "2026-04-13T12:37:51.302632+00:00", "updated": "2026-04-13T12:53:39.089055+00:00", "vendors": ["fpt_software", "fpt_software$PRODUCT$nightwolf_penetration_testing_platform"]}