{"id":"CVE-2026-112204","kind":"vulnerability","aliases":["CVE-2026-112204"],"related":[],"title":"WidzialniCMS: reflected XSS in index.php lets attackers run scripts in browsers","description":"WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft.\n\n\nThis issue has been fixed in version 2.5.","summary":"WidzialniCMS has a reflected cross-site scripting flaw in its /index.php endpoint. A victim who opens a crafted link runs attacker-chosen JavaScript in their browser, which can steal session cookies.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WidzialniCMS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cms","other","php","widzialnicms"],"not_affected_if":["version-2.5-or-later"],"how_to_check":"- Check the installed WidzialniCMS version against the fixed release `2.5`","fix":"- WidzialniCMS: upgrade to `2.5`","status":"open","published_at":"2026-11-09T13:17:04+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","triaged_at":"2026-11-09T13:27:47+00:00","updated_at":"2026-11-09T13:27:47+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T13:27:47Z","model":"claude-haiku-5-5","output":{"fix":"- WidzialniCMS: upgrade to `2.5`","reach":"internet","title":"WidzialniCMS: reflected XSS in index.php lets attackers run scripts in browsers","impact":"medium","summary":"WidzialniCMS has a reflected cross-site scripting flaw in its /index.php endpoint. A victim who opens a crafted link runs attacker-chosen JavaScript in their browser, which can steal session cookies.","audience":"businesses","category":"other","nicknames":[],"who_cares":["widzialnicms","php","cms"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs scripts in victim browsers and steals session cookies","analyst_note":"Confirm the affected version range beyond the single 'fixed in 2.5' statement and check the NVD entry for the CVSS vector.","how_to_check":"- Check the installed WidzialniCMS version against the fixed release `2.5`\n- unknown","plain_action":"","product_name":"WidzialniCMS","needs_analyst":true,"not_affected_if":["version-2.5-or-later"],"who_is_affected":"Sites running WidzialniCMS versions before 2.5 are exposed through the /index.php endpoint. The sources do not say which configurations or pages are needed to reach the flaw, so the exposure of any given install is unknown.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000719,"input_tokens":4549,"output_tokens":529,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112204':14A,17A '-2026':13A,16A '/index.php':34B,64C '2.5':97C 'allow':85C 'arbitrari':77C 'attack':7A,45B,67C 'attacker-chosen':44B 'browser':11A,50B,84C 'chosen':46B 'cms':19B 'cooki':55B,88C 'craft':41B 'cross':28B 'cross-sit':27B 'cve':12A,15A 'e.g':86C 'endpoint':35B,65C 'execut':79C 'fix':94C 'flaw':31B 'index.php':5A 'issu':91C 'javascript':47B,78C 'let':6A 'link':42B 'open':39B,74C 'php':21B 'prepar':69C 'reflect':2A,26B,60C 'result':75C 'run':8A,43B 'script':9A,30B 'session':54B,87C 'site':29B 'steal':53B 'theft':89C 'url':71C 'version':96C 'victim':37B,82C 'vulner':58C 'widzialnicm':1A,22B,23B,56C 'widzialnicms':18A 'xss':3A,61C","nicknames":[],"mitigations":[],"who_affected":"Sites running WidzialniCMS versions before 2.5 are exposed through the /index.php endpoint. The sources do not say which configurations or pages are needed to reach the flaw, so the exposure of any given install is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["widzialnicms"],"ptokens":["widzialnicms"],"labels":["cms","medium","other","php","vendor","widzialnicms"],"campaign_type":null,"search_a":"'-112204':14A,17A '-2026':13A,16A 'attack':7A 'browser':11A 'cve':12A,15A 'index.php':5A 'let':6A 'reflect':2A 'run':8A 'script':9A 'widzialnicm':1A 'widzialnicms':18A 'xss':3A","search_b":"'/index.php':34B 'attack':45B 'attacker-chosen':44B 'browser':50B 'chosen':46B 'cms':19B 'cooki':55B 'craft':41B 'cross':28B 'cross-sit':27B 'endpoint':35B 'flaw':31B 'javascript':47B 'link':42B 'open':39B 'php':21B 'reflect':26B 'run':43B 'script':30B 'session':54B 'site':29B 'steal':53B 'victim':37B 'widzialnicm':22B,23B","search_c":"'/index.php':64C '2.5':97C 'allow':85C 'arbitrari':77C 'attack':67C 'browser':84C 'cooki':88C 'e.g':86C 'endpoint':65C 'execut':79C 'fix':94C 'issu':91C 'javascript':78C 'open':74C 'prepar':69C 'reflect':60C 'result':75C 'session':87C 'theft':89C 'url':71C 'version':96C 'victim':82C 'vulner':58C 'widzialnicm':56C 'xss':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112204","severity":null,"published_at":"2026-11-09T13:17:04+00:00","modified_at":"2026-11-09T13:17:04+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","fetched_at":"2026-11-09T13:26:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}