# CVE-2026-67175: Chargemap stored cross-site scripting in user profile

Source: https://junglewise.ai/threats/cve-2026-67175-chargemap-contains-a-stored-cross-site-scripting-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-67175 · Severity: medium · CVSS 4.6 · Published 2026-11-10

Chargemap is a charging station locator and management platform. An authenticated attacker can inject malicious code into their profile that executes when other users view it, allowing account takeover, credential theft, or session hijacking of victims who view the malicious profile.

Technologies: [Chargemap](https://junglewise.ai/threats/technologies/chargemap). Vendors: [Chargemap](https://junglewise.ai/threats/vendors/chargemap).

## Quick answers

**Is CVE-2026-67175 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67175 being exploited in the wild.

**How severe is CVE-2026-67175?** Medium severity, with a CVSS score of 4.6, published 10 November 2026.

**Which products and versions are affected?** Chargemap Chargemap.

**Is there a fix for CVE-2026-67175?** Yes: fixed in Not specified in advisory. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67175 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-67175?** Check whether you run Chargemap. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Not specified in advisory

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in the user profile page. An authenticated attacker can craft and inject a malicious payload into their profile that persists server-side and executes in the browsers of other users who view the attacker's profile. No additional user interaction or privileges are required beyond authentication.

## Affected products

- Chargemap Chargemap

## Timeline

- 2026-11-10: disclosed
- 2026-07-17: patched

## References

- [https://github.com/praksokchea/CVE-2026-67175](https://github.com/praksokchea/CVE-2026-67175)
- [https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-02.json](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-02.json)

## Related threats

- [Chargemap open redirect in authentication login endpoint](https://junglewise.ai/threats/cve-2026-67176-chargemap-contains-an-open-redirect-vulnerability-in-the)