CVE-2026-34416CWE-79

OSCAL-GUI Reflected XSS via project parameter in oscal.php

Medium · published June 9, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
26.0
In the wild
Unconfirmed
What it is

OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious input through the project request parameter. Attackers can craft a malicious URL containing unsanitized input that breaks out of the JavaScript string and HTML attribute context in the body onload event handler to execute arbitrary scripts when the link is visited by a victim.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00338 · 26.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-09T20:59Z
EPSS history
Timeline
  • 09 JUN 20:59Z
    OSCAL-GUI Reflected XSS via project parameter in oscal.php
    cvelistv5