---
id: "CVE-2026-111877"
kind: "vulnerability"
aliases: ["CVE-2026-111877"]
title: "Books4Cash: search.php Search argument allows cross-site scripting"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["books4cash", "other", "php", "self-hosted"]
not_affected_if: ["not-deployed"]
published_at: "2026-10-18T07:16:53+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:30:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111877", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Books4Cash: search.php Search argument allows cross-site scripting

A reflected cross-site scripting flaw exists in the search.php file of the Books4Cash project, triggered through the Search argument. An attacker can make a visitor's browser run script in the context of the site by getting them to open a crafted link.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the application is a Books4Cash deployment from dext34-morgan, for example by looking for a search.php file in the web root.
- Confirm the deployed commit: unknown if it is at or before `a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571`.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111877

## From the sources

A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a manipulation of the argument Search can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_