Refine your search

2 vulnerabilities found for SOY CMS by Tsuyoshi Saito

jvndb-2026-000125
Vulnerability from jvndb
Published
2026-08-28 15:52
Modified
2026-08-28 15:52
Severity ?
9.8 (Critical) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Multiple vulnerabilities in SOY series
Details
SOY series provided by Tsuyoshi Saito contain multiple vulnerabilities listed below.<a href='https://cwe.mitre.org/data/definitions/79.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/502.html' target='_blank'></a><ul><li>Cross-site Scripting (CWE-79) - CVE-2026-73827, CVE-2026-77838, CVE-2026-78238</li><li>Deserialization of Untrusted Data (CWE-502) - CVE-2026-78032</li></ul>Shogo Kumamaru of LAC Co., Ltd. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000125.html",
  "dc:date": "2026-08-28T15:52+09:00",
  "dcterms:issued": "2026-08-28T15:52+09:00",
  "dcterms:modified": "2026-08-28T15:52+09:00",
  "description": "SOY series provided by Tsuyoshi Saito contain multiple vulnerabilities listed below.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/79.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/502.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eCross-site Scripting (CWE-79) - CVE-2026-73827, CVE-2026-77838, CVE-2026-78238\u003c/li\u003e\u003cli\u003eDeserialization of Untrusted Data (CWE-502) - CVE-2026-78032\u003c/li\u003e\u003c/ul\u003eShogo Kumamaru of LAC Co., Ltd. reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000125.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:misc:saitodev_soy_calendar",
      "@product": "SOY Calendar",
      "@vendor": "Tsuyoshi Saito",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:saitodev_soy_cms",
      "@product": "SOY CMS",
      "@vendor": "Tsuyoshi Saito",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:misc:saitodev_soy_gallery",
      "@product": "SOY Gallery",
      "@vendor": "Tsuyoshi Saito",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "9.8",
    "@severity": "Critical",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000125",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN04485476/index.html",
      "@id": "JVN#04485476",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-73827",
      "@id": "CVE-2026-73827",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-77838",
      "@id": "CVE-2026-77838",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-78032",
      "@id": "CVE-2026-78032",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-78238",
      "@id": "CVE-2026-78238",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in SOY series"
}

CVE-2026-78032 (GCVE-0-2026-78032)
Vulnerability from cvelistv5
Published
2026-08-28 06:11
Modified
2026-08-28 16:10
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-502 - Deserialization of untrusted data
Summary
SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege.
References
Impacted products
Vendor Product Version
Tsuyoshi Saito SOY CMS Version: 0   ≤ 3.24.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-78032",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T16:10:47.152169Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T16:10:55.790Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SOY CMS",
          "vendor": "Tsuyoshi Saito",
          "versions": [
            {
              "lessThanOrEqual": "3.24.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SOY CMS  contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "Deserialization of untrusted data",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T06:11:11.567Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://saitodev.co/article/7105"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN04485476/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-78032",
    "datePublished": "2026-08-28T06:11:11.567Z",
    "dateReserved": "2026-08-24T04:26:30.527Z",
    "dateUpdated": "2026-08-28T16:10:55.790Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}