CVE-2026-34907CWE-79

Reflected Cross-Site Scripting (XSS) in Wirtualna Uczelnia

Medium · published June 2, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

Wirtualna Uczelnia is vulnerable to Reflected Cross‑Site Scripting (XSS) due to insecure handling of the locale parameter across multiple endpoints. An attacker can craft a malicious URL with JavaScript embedded in the locale parameter and send it to a victim. When the victim opens the link, the injected script will be executed in their browser.

This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00453 · 38.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-02T08:31Z
EPSS history
Timeline
  • 02 JUN 08:31Z
    Reflected Cross-Site Scripting (XSS) in Wirtualna Uczelnia
    cvelistv5