CVE-2026-116212
Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend us
CVSS
5.4
Média
EPSS
0.2%
p7
KEV
—
Exploit Today
2
0-100
Publicado: 26 de out. de 2026 · Última mod.: 2 de nov. de 2026 · CWE-79
0.2%EPSS · 30 dias0.2%
2026-10-272026-11-07
Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions.
- github.comhttps://github.com/webasyst/webasyst-framework
- github.comhttps://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/lib/actions/album/photosAlbumSave.controller.php#L107
- github.comhttps://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/templates/actions/dialog/DialogAlbumSettings.html#L36
- github.comhttps://github.com/webasyst/webasyst-framework/issues/395
- www.vulncheck.comhttps://www.vulncheck.com/advisories/webasyst-framework-through-4.4.0-stored-xss-via-photos-album-url
- github.comhttps://github.com/webasyst/webasyst-framework/issues/395
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1245524.8 MÉD—
———Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes when other users, including root, view the list page.2hCVE-2026-124494——
———SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.2hCVE-2026-124493——
———SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft.2hCVE-2026-1244927.6 ALT—
———SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a victim opens the link modal and types # in the URL input.2hCVE-2026-1244916.4 MÉD—
———SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.2hCVE-2026-1244746.1 MÉD—
———MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of view_entry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete bookings, or perform administrative actions.2h