CVE-2026-39724: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in veppa HTTP Requests Manager

CVE-2026-39724 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in veppa HTTP Requests Manager affecting versions up to 1.3.11. The flaw arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that could execute in the context of the victim's browser. The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions impacting confidentiality, integrity, and availability to a limited extent. The vulnerability does not require authentication, increasing the risk of exploitation. However, user interaction is required to trigger the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution and consider implementing web application firewalls or input validation as temporary mitigations. Monitor vendor communications for updates on patches or official mitigations.