CVE-2026-127285 · Other
NO FIX YET
A flaw in the bg_forum.php file of Cairo-Dock Glx-Dock 3.4.0 lets a remote attacker inject script through the f argument. A public exploit exists, and the vendor did not respond to disclosure.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites or tools that run Glx-Dock 3.4.0 with a bg_forum.php page reachable from the network are the exposed systems. The sources do not say which deployments serve that file by default. unknown
Not affected if glx-dock-not-installed
Who cares cairo-dock, glx-dock, web
Unknown from the sources.
No fix yet, per the sources.
A flaw has been found in Cairo-dock Glx-Dock 3.4.0. The affected element is an unknown function of the file bg_forum.php of the component href Attribute Handler. This manipulation of the argument f causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.