Live › vulnerability › CVE-2026-7190
The ICTBroadcast demo environment's login.php reflects the editForm[extension_username] parameter into its response without filtering. An attacker who gets a victim to open a crafted link can run arbitrary JavaScript in the victim's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 09:23 UTC. All times on this page are UTC.
Only the demo environment of ICTBroadcast is named in the sources, and the flaw is in its login.php endpoint. Teams running a production ICTBroadcast instance should confirm whether it exposes the same endpoint, since the sources do not say. unknown beyond that.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in the ‘login.php’ endpoint, where the ‘editForm[extension_username]’ parameter is reflected in the response without proper filtering. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser once the victim accesses the malicious URL.
This page as .md · .json · in your agent: get_signal("CVE-2026-7190")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.