CVE-2026-9696

Name of the Vulnerable Software and Affected Versions Download Manager versions prior to 3.3.59

Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the not found parameter, which execute when a user accesses the affected page.

Recommendations Update to a version newer than 3.3.58. Avoid using the not found parameter until the update is applied.