PT-2026-114795

CVE-2026-74920

Published

2026-10-15

Updated

2026-10-24

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Document Gallery versions prior to 5.1.2

Description An unauthenticated AJAX action fails to properly sanitize and escape user input before reflecting it within an HTML attribute. This leads to a Reflected Cross-Site Scripting (XSS) issue, where a malicious script is reflected back to the user, potentially affecting any visitor, including logged-in administrators. The issue specifically involves the data-shortcode attribute.

Recommendations Update Document Gallery to version 5.1.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Pedro Pinho

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers