CVE-2026-5725

Name of the Vulnerable Software and Affected Versions Favicon Rotator versions prior to 1.2.12

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via request parameters starting with the prefix fvrt , enabling the injection of arbitrary web scripts that execute when a user is tricked into clicking a malicious link.

Recommendations Update Favicon Rotator to version 1.2.12 or later. As a temporary mitigation, restrict or filter request parameters starting with fvrt to prevent script injection.