---
id: "CVE-2026-7190"
kind: "vulnerability"
aliases: ["CVE-2026-7190"]
title: "ICTBroadcast demo: login page reflects input, allowing script injection"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ictbroadcast", "other", "php"]
not_affected_if: ["demo-only-deployment"]
published_at: "2026-10-29T09:17:08+00:00"
first_seen_at: "2026-10-29T09:23:58+00:00"
updated_at: "2026-10-29T09:24:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7190", "first_seen_at": "2026-10-29T09:23:58+00:00"}]
---

# ICTBroadcast demo: login page reflects input, allowing script injection

The ICTBroadcast demo environment's login.php reflects the editForm[extension_username] parameter into its response without filtering. An attacker who gets a victim to open a crafted link can run arbitrary JavaScript in the victim's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-29T09:23:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-7190

## From the sources

A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in the ‘login.php’ endpoint, where the ‘editForm[extension_username]’ parameter is reflected in the response without proper filtering. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser once the victim accesses the malicious URL.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_