# CVE-2026-14752: mjperpinosa stumasy stored XSS in add_definition reference field

Source: https://junglewise.ai/threats/cve-2026-14752-mjperpinosa-stumasy-stored-xss-in-add-definition-reference-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-05. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2026-14752 · Severity: low · CVSS 3.5 · Published 2026-07-05

A security vulnerability exists in stumasy, a student management and social networking platform. The system fails to properly clean user-provided dictionary references, allowing a malicious user to inject scripts that run in other users' browsers. This could allow an attacker to perform unauthorized actions on behalf of other students or staff, potentially leading to account takeover or data manipulation.

Technologies: [Mjperpinosa Stumasy](https://junglewise.ai/threats/technologies/stumasy). Vendors: [Mjperpinosa](https://junglewise.ai/threats/vendors/mjperpinosa).

## Quick answers

**Is CVE-2026-14752 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14752 being exploited in the wild.

**How severe is CVE-2026-14752?** Low severity, with a CVSS score of 3.5, published 5 July 2026.

**Which products and versions are affected?** Mjperpinosa Stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be.

**Is there a fix for CVE-2026-14752?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14752 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-14752?** Check whether you run Mjperpinosa Stumasy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in mjperpinosa stumasy up to commit 327d1b0f. The flaw is located in the add_definition function within application/PHP/objects/notes/add_into_dictionary.php, where the 'reference' parameter is stored without adequate sanitization. When the dictionary entry is later retrieved, the application fails to encode the output, and the frontend (notes.js) inserts the raw server response into the DOM using the jQuery .html() method. A remote authenticated attacker can exploit this by submitting a malicious payload in the reference field, which executes arbitrary JavaScript in the context of any user viewing the affected dictionary entry. As of the advisory date, no official patch has been released.

## Affected products

- mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be

## Timeline

- 2026-06-05: disclosed: Issue reported to the project maintainer via GitHub issue #8
- 2026-07-05: advisory: CVE-2026-14752 published via VulDB/NVD

## References

- [https://github.com/mjperpinosa/stumasy/](https://github.com/mjperpinosa/stumasy/)
- [https://github.com/mjperpinosa/stumasy/issues/8](https://github.com/mjperpinosa/stumasy/issues/8)
- [https://vuldb.com/cve/CVE-2026-14752](https://vuldb.com/cve/CVE-2026-14752)
- [https://vuldb.com/submit/849495](https://vuldb.com/submit/849495)
- [https://vuldb.com/vuln/376341](https://vuldb.com/vuln/376341)
- [https://vuldb.com/vuln/376341/cti](https://vuldb.com/vuln/376341/cti)

## Related threats

- [mjperpinosa stumasy IDOR in Note and Assignment Handlers](https://junglewise.ai/threats/cve-2026-14753-mjperpinosa-stumasy-idor-in-note-and-assignment-handlers)
- [mjperpinosa stumasy SQL injection in Notes_controller](https://junglewise.ai/threats/cve-2026-14751-mjperpinosa-stumasy-sql-injection-in-notes-controller)
- [mjperpinosa stumasy SQL injection in dictionary authorization](https://junglewise.ai/threats/cve-2026-14750-mjperpinosa-stumasy-sql-injection-in-dictionary-authorization)
- [mjperpinosa stumasy code injection in imba_calculator](https://junglewise.ai/threats/cve-2026-14749-mjperpinosa-stumasy-code-injection-in-imba-calculator)
- [mjperpinosa stumasy unrestricted upload in change_profile_image.php](https://junglewise.ai/threats/cve-2026-10807-mjperpinosa-stumasy-unrestricted-upload-in-change-profile-image)