{"id":"CVE-2026-111877","kind":"vulnerability","aliases":["CVE-2026-111877"],"related":[],"title":"Books4Cash: search.php Search argument allows cross-site scripting","description":"A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a manipulation of the argument Search can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.","summary":"A reflected cross-site scripting flaw exists in the search.php file of the Books4Cash project, triggered through the Search argument. An attacker can make a visitor's browser run script in the context of the site by getting them to open a crafted link.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["books4cash","other","php","self-hosted"],"not_affected_if":["not-deployed"],"how_to_check":"- Check whether the application is a Books4Cash deployment from dext34-morgan, for example by looking for a search.php file in the web root.\n- Confirm the deployed commit: unknown if it is at or before `a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571`.","fix":null,"status":"open","published_at":"2026-10-18T07:16:53+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:30:58+00:00","updated_at":"2026-10-25T04:30:58+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:30:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Books4Cash: search.php Search argument allows cross-site scripting","impact":"medium","summary":"A reflected cross-site scripting flaw exists in the search.php file of the Books4Cash project, triggered through the Search argument. An attacker can make a visitor's browser run script in the context of the site by getting them to open a crafted link.","category":"other","nicknames":[],"who_cares":["books4cash","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Script runs in visitors' browsers, session cookies or actions may be stolen.","analyst_note":"Find a fix or the affected deployment footprint; check the NVD entry and the project repository for a patch or a successor.","how_to_check":"- Check whether the application is a Books4Cash deployment from dext34-morgan, for example by looking for a search.php file in the web root.\n- Confirm the deployed commit: unknown if it is at or before `a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571`.","needs_analyst":true,"not_affected_if":["not-deployed"],"who_is_affected":"Teams running the Books4Cash web application from the dext34-morgan repository are exposed, reachable from the internet if the site is public. The sources do not say whether a fixed version exists; the repository is reported as inactive for many years, so a patch is unlikely. Sites that do not run this code can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000607,"input_tokens":3377,"output_tokens":539,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111877':12A,15A '-2026':11A,14A 'a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571':78C 'activ':127C 'affect':80C 'allow':5A 'argument':4A,42B,93C 'attack':44B,102C 'books4cash':1A,16B,36B,75C 'browser':50B 'code':119C 'context':55B 'craft':65B 'cross':7A,25B,98C 'cross-sit':6A,24B 'cve':10A,13A 'determin':70C 'dext34':73C 'dext34-morgan':72C 'disclos':113C 'execut':88C 'exist':29B 'exploit':109C 'file':33B,86C 'flaw':28B 'get':60B 'host':21B 'lead':96C 'link':66B 'make':46B 'mani':129C 'manipul':90C 'may':103C,115C 'morgan':74C 'open':63B 'part':83C 'perform':105C 'php':18B 'project':37B,123C 'public':112C 'reflect':23B 'remot':107C 'repositori':120C 'run':51B 'script':9A,27B,52B,100C 'search':3A,41B,94C 'search.php':2A,32B,87C 'self':20B 'self-host':19B 'site':8A,26B,58B,99C 'trigger':38B 'unknown':82C 'util':117C 'visitor':48B 'vulner':68C 'year':130C","nicknames":[],"mitigations":[],"who_affected":"Teams running the Books4Cash web application from the dext34-morgan repository are exposed, reachable from the internet if the site is public. The sources do not say whether a fixed version exists; the repository is reported as inactive for many years, so a patch is unlikely. Sites that do not run this code can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T07:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111877","severity":null,"published_at":"2026-10-18T07:16:53+00:00","modified_at":"2026-10-22T03:16:31+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}