CVE-2026-112204

CVSS 5.1 (medium) · published 2026-11-09

WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft. This issue has been fixed in version 2.5.

Weakness: CWE-79

Source: NVD CVE-2026-112204

References

• https://cert.pl/posts/2026/11/CVE-2026-110468
• https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.