Live › vulnerability › CVE-2026-109895
Go to dashboardBooktics by Arraytics has a DOM-based cross-site scripting flaw, where page script handles input unsafely in the browser. An attacker who gets a user to open a crafted link can run script in that user's session and act as them on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Booktics version or earlier are affected, and the flaw needs a victim to open a crafted page or link. The sources do not say which page or input triggers it, so unknown whether a site without the public booking pages is exposed. Sites that do not run Booktics can skip it.
1.0.29No product ranges from the sources yet.
1.0.29 or lower.1.0.29; unknown if the sources name the fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29.
This page as .md · .json · in your agent: get_signal("CVE-2026-109895")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.