{"id":"CVE-2026-105323","kind":"vulnerability","aliases":["CVE-2026-105323"],"related":[],"title":"Kulga News Software: reflected XSS lets attackers run scripts in visitors' browsers","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company Kulga News Software allows Reflected XSS.\n\nThis issue affects Kulga News Software: from v26.7.4 before v26.10.0.","summary":"Kulga News Software from v26.7.4 before v26.10.0 does not neutralize input in generated web pages, so a crafted link can inject a script. An attacker who gets a victim to open that link can run JavaScript in the victim's browser session on the site.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","kulga-news","package","web-frontend"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed Kulga News Software version against `v26.10.0`; versions from `v26.7.4` up to but not including `v26.10.0` are affected.\n- Confirm the exact installed version with the vendor's admin page or package metadata; the sources do not give a specific command.","fix":"- Upgrade Kulga News Software to `v26.10.0` or later.\n- Until upgraded, unknown whether a configuration workaround exists; the sources do not say.","status":"open","published_at":"2026-10-27T12:17:04+00:00","first_seen_at":"2026-10-27T12:31:37+00:00","triaged_at":"2026-10-27T12:32:09+00:00","updated_at":"2026-10-27T12:32:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T12:32:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Kulga News Software to `v26.10.0` or later.\n- Until upgraded, unknown whether a configuration workaround exists; the sources do not say.","reach":"internet","title":"Kulga News Software: reflected XSS lets attackers run scripts in visitors' browsers","impact":"medium","summary":"Kulga News Software from v26.7.4 before v26.10.0 does not neutralize input in generated web pages, so a crafted link can inject a script. An attacker who gets a victim to open that link can run JavaScript in the victim's browser session on the site.","category":"package","nicknames":[],"who_cares":["kulga-news","cms","web-frontend"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs scripts in visitors' browsers and steals session data","analyst_note":"Check the NVD entry and the vendor's advisory for the exact vulnerable parameter and whether a workaround exists before v26.10.0.","how_to_check":"- Check the installed Kulga News Software version against `v26.10.0`; versions from `v26.7.4` up to but not including `v26.10.0` are affected.\n- Confirm the exact installed version with the vendor's admin page or package metadata; the sources do not give a specific command.","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Sites running Kulga News Software from v26.7.4 before v26.10.0 are exposed, since reflected input is rendered into pages. Teams running other news or CMS products, or versions outside that range, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000621,"input_tokens":3312,"output_tokens":580,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105323':15A,18A '-2026':14A,17A 'affect':100C 'allow':95C 'attack':7A,51B 'browser':12A,67B 'cms':19B 'compani':91C 'craft':44B 'cross':81C 'cross-sit':80C 'cve':13A,16A 'frontend':26B 'generat':39B,79C 'get':53B 'improp':72C 'inject':47B 'input':37B,75C 'issu':99C 'javascript':62B 'kulga':1A,21B,27B,86C,92C,101C 'kulga-new':20B 'let':6A 'limit':90C 'link':45B,59B 'neutral':36B,73C 'news':2A,22B,28B,93C,102C 'open':57B 'packag':23B 'page':41B,78C 'reflect':4A,96C 'run':8A,61B 'script':9A,49B,83C 'session':68B 'site':71B,82C 'softwar':3A,29B,87C,94C,103C 'telecommun':89C 'v26.10.0':33B,107C 'v26.7.4':31B,105C 'victim':55B,65B 'visitor':11A 'vulner':84C 'web':25B,40B,77C 'web-frontend':24B 'xss':5A,97C","nicknames":[],"mitigations":[],"who_affected":"Sites running Kulga News Software from v26.7.4 before v26.10.0 are exposed, since reflected input is rendered into pages. Teams running other news or CMS products, or versions outside that range, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T12:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105323","severity":null,"published_at":"2026-10-27T12:17:04+00:00","modified_at":"2026-10-27T12:17:04+00:00","first_seen_at":"2026-10-27T12:31:37+00:00","fetched_at":"2026-10-27T12:31:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}