PT-2026-140402
CVE-2026-112204
·
Published
2026-11-09
·
Updated
2026-11-09
Description by
CVSS 4.0
5.1
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft.
This issue has been fixed in version 2.5.
Found an issue in the description? Have something to add? Feel free to write us 👾