{"id":"CVE-2026-7190","kind":"vulnerability","aliases":["CVE-2026-7190"],"related":[],"title":"ICTBroadcast demo: login page reflects input, allowing script injection","description":"A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in the ‘login.php’ endpoint, where the ‘editForm[extension_username]’ parameter is reflected in the response without proper filtering. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser once the victim accesses the malicious URL.","summary":"The ICTBroadcast demo environment's login.php reflects the editForm[extension_username] parameter into its response without filtering. An attacker who gets a victim to open a crafted link can run arbitrary JavaScript in the victim's browser.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ictbroadcast","other","php"],"not_affected_if":["demo-only-deployment"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-29T09:17:08+00:00","first_seen_at":"2026-10-29T09:23:58+00:00","triaged_at":"2026-10-29T09:24:36+00:00","updated_at":"2026-10-29T09:24:36+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-29T09:24:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ICTBroadcast demo: login page reflects input, allowing script injection","impact":"medium","summary":"The ICTBroadcast demo environment's login.php reflects the editForm[extension_username] parameter into its response without filtering. An attacker who gets a victim to open a crafted link can run arbitrary JavaScript in the victim's browser.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ictbroadcast","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs JavaScript in a victim's browser session","analyst_note":"Confirm whether the flaw affects production ICTBroadcast builds, not just the demo, and find the fixed version at https://nvd.nist.gov/vuln/detail/CVE-2026-7190.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["demo-only-deployment"],"who_is_affected":"Only the demo environment of ICTBroadcast is named in the sources, and the flaw is in its login.php endpoint. Teams running a production ICTBroadcast instance should confirm whether it exposes the same endpoint, since the sources do not say. unknown beyond that.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":4178,"output_tokens":486,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-7190':12A,15A 'access':116C 'affect':68C 'allow':7A,100C 'arbitrari':49B,105C 'attack':37B,102C 'browser':55B,112C 'code':107C 'could':99C 'craft':45B 'cross':58C 'cross-sit':57C 'cve':10A,13A 'demo':2A,21B,70C 'editform':27B,82C 'endpoint':79C 'environ':22B,71C 'execut':104C 'exploit':95C 'extens':28B,83C 'filter':35B,93C 'found':75C 'get':39B 'ictbroadcast':1A,16B,20B,65C 'inject':9A 'input':6A 'javascript':50B,106C 'link':46B 'login':3A 'login.php':24B,78C 'malici':118C 'open':43B 'page':4A 'paramet':30B,85C 'php':18B 'proper':92C 'reflect':5A,25B,87C 'respons':33B,90C 'run':48B 'script':8A,60C 'site':59C 'softwar':66C 'success':94C 'url':119C 'usernam':29B,84C 'victim':41B,53B,110C,115C 'vulner':62C,73C,98C 'without':34B,91C 'xss':61C","nicknames":[],"mitigations":[],"who_affected":"Only the demo environment of ICTBroadcast is named in the sources, and the flaw is in its login.php endpoint. Teams running a production ICTBroadcast instance should confirm whether it exposes the same endpoint, since the sources do not say. unknown beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-7190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7190","severity":null,"published_at":"2026-10-29T09:17:08+00:00","modified_at":"2026-10-29T09:17:08+00:00","first_seen_at":"2026-10-29T09:23:58+00:00","fetched_at":"2026-10-29T09:23:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}