CVE-2026-111877CWE-79CWE-94cross-site-scriptingcode-injection

CVE-2026-111877

Medium · published October 18, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
17.3
In the wild
Unconfirmed
What it is

A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a manipulation of the argument Search can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00263 · 17.3th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-10-18T11:16Z
References (4)
https://vuldb.com/cve/CVE-2026-111877 · [email protected]https://vuldb.com/submit/1005404 · [email protected]https://vuldb.com/vuln/421589 · [email protected]https://vuldb.com/vuln/421589/cti · [email protected]
EPSS history
Timeline
  • 19 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 18 OCT 06:00Z
    dext34-morgan Books4Cash search.php cross site scripting
    cvelistv5
  • 18 OCT 06:00Z
    dext34-morgan Books4Cash search.php cross site scripting
    cvelistv5