CVE-2026-95665

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description A reflected cross-site scripting (XSS) issue exists in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's json encode() function without hex-encoding flags. Since json encode() does not escape single quotes by default, an attacker can inject a single-quote character to terminate the string and execute arbitrary JavaScript in the browser session of an authenticated user who navigates to a crafted URL. This affects the Default and UiBeta themes. Successful exploitation can lead to session hijacking, unauthorized actions, or exfiltration of sensitive session data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.