SecurinZero Days
    Email Us
    Zero-Day Research/CVE-2015-9260
    ▲ MediumCVSS 5.4✓ PatchedEPSS 0.00249%

    Reflected Cross-Site Scripting in BEdita

    An issue was discovered in BEdita before 3.7.0. A cross-site scripting (XSS) attack occurs via a crafted pages/showObjects URI, as demonstrated by appending a payload to a pages/showObjects/2 URI.

    CVE IDCVE-2015-9260
    CVSS v3.15.4 Medium
    VendorBEdita
    CWECWE-79
    DisclosedOct 14, 2015
    StatusFixed
    All advisories
    • 01Description
    • 02Proof of Concept
    • 03Impact
    • 04Remediation
    • 05Timeline
    • 06References
    01/Description

    What this actually is.

    Technical background, root cause, and affected surface.

    A cross-site scripting vulnerability was identified on the Bedita CMS 3.6.0 Publication module. An XSS attack occurs via a crafted pages/showObjects URI, as demonstrated by appending a payload to a pages/showObjects/2/0/0/leafs URI.

    Vendor
    BEdita
    Affected Product
    BEdita
    CVE
    CVE-2015-9260
    Securin ID
    2015-CSW-10-1010
    Status
    Fixed
    Date
    October 14, 2015
    Severity
    Medium
    CVSS Score
    5.4
    Vector
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    CWE
    CWE-79
    02/Proof of Concept

    From one request
    to root shell.

    Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.

    5.4CVSS 3.1
    VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    ScopeChanged
    ImpactC:L / I:L / A:N
    SeverityMedium

    Issue: The POST request URL http://192.168.56.104/bedita/beditaapp/pages/showObjects/2/0/0/leafs of Bedita CMS 3.6.0 is vulnerable to Cross-Site Scripting (XSS).

    PoC · Exploitation Steps▲ trigger
    01Figure 01: XSS Payload injected in the given URL http://192.168.56.104/bedita/beditaapp/pages/showObjects/2/0/0/leafs is reflected back in the response.02Figure 02: XSS Payload gets executed in the browser.
    03/Impact

    What an attacker does to you.

    Post-exploitation outcomes mapped to CVSS impact metrics.

    If an attacker can control a script that is executed in the victim’s browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.

    04/Remediation

    Fix it. In this order.

    A runbook, not a checklist. Sequence matters — assume compromise before you act.

    Download the latest updated version of  Bedita and apply the update as per vendor advisory.

    Securin advisory — For coordinated remediation support or threat-actor briefings related to CVE-2015-9260, contact disclose@securin.io
    05/Disclosure Timeline

    Vendors moved in days.
    Attackers in hours.

    Reconstructed from vendor advisories, CISA bulletins, and Securin research records.

    Oct 14, 2015

    Reported to Vendor

    Oct 14, 2015

    Vendor Responded

    Oct 15, 2015

    Vendor Responded “Under Investigation”

    Oct 31, 2015

    Follow up Email

    Dec 11, 2015

    Vendor Released Fixed

    Apr 07, 2018

    CVE Assigned

    Disclosed 58 days after discovery

    06/References

    Cite, verify, go deeper.

    Primary sources — NVD, CISA KEV, and machine-readable IoC feed.

    NVD

    NVD — CVE-2015-9260

    nvd.nist.gov/vuln/detail/CVE-2015-9260 →
    SEC

    Securin VI — Full Technical Analysis

    vi.securin.io →

    Let Securin level up your security posture.

    Get a live exposure assessment, threat-actor briefing tailored to your sector, and IoC mapping for your SIEM.

    Browse all advisories
    SecurinSecurinZero Days

    Securin's zero-day research operation combines frontier AI models with a decade of offensive expertise — discovering, validating, and coordinating the disclosure of high-impact vulnerabilities at a scale and speed no human team achieves alone.

    Glossary
    © 2026 Securin Inc · CVE Numbering Authority
    Privacy Policy·Data Processing Addendum