CVE-2026-81281: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in silverks Graphene

This vulnerability, identified as CWE-79, affects silverks Graphene software versions up to 2.9.4. It allows a subscriber-level user to perform Cross-Site Scripting (XSS) attacks due to improper input neutralization during web page generation. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability in a partial scope. No patch or official remediation level has been published as of the current data.

Successful exploitation could allow an attacker with subscriber privileges to execute arbitrary scripts in the context of the victim's browser, potentially leading to partial confidentiality, integrity, and availability impacts. This could result in unauthorized actions or data exposure within the affected application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting subscriber privileges and applying web application firewall rules to detect and block XSS payloads where possible.