CVE-2026-13140— Stored Cross-Site Scripting in Canarytokens.org
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-13140
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Stored Cross-Site Scripting in Canarytokens.org
Source: NVD (National Vulnerability Database)
Vulnerability Description
Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledge of a random identifier. This issue affects Canarytokens: from Docker tag sha-4116b92cb before sha-f5aa5c4e, from Git commit 4116b92cb before f5aa5c4e.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Thinkst Applied Research | Canarytokens | sha-4116b92cb ~ f5aa5c4e | - |
II. Public POCs for CVE-2026-13140
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13140
请登录查看更多情报信息。
Other References for CVE-2026-13140 (1)
IV. Related Vulnerabilities
Same product: Canarytokens
- CVE-2026-12888
HTML injection in the Canarytoken Google Chat notification - CVE-2026-11859
HTML injection in the Canarytoken links email - CVE-2026-10729
HTML injection in the notification email for "Slow Redirect" - CVE-2026-28355
"PWA" Canarytoken Vulnerable to Stored Self Cross-Site Scrip - CVE-2024-41664
Blind SSRF via Canarytoken Webhook
Same weakness: CWE-79
- CVE-2026-57656
WordPress Hester Core plugin <= 1.1.8 - Cross Site Scripting - CVE-2026-57651
WordPress Ghost Kit plugin <= 3.6.0 - Cross Site Scripting ( - CVE-2026-57650
WordPress Magazine Blocks plugin <= 1.8.3 - Cross Site Scrip - CVE-2026-57638
WordPress Fluent Booking plugin <= 2.1.0 - Cross Site Script - CVE-2026-57629
WordPress StatCounter plugin <= 2.1.1 - Cross Site Scripting
V. Comments for CVE-2026-13140
No comments yet