Kulga News Software CVE-2026-105323

Exploitation requires an attacker to lure a specific victim into clicking or loading an attacker-crafted URL whose input is reflected unneutralized into a generated page (UI:R in the CVSS vector) - it is not a hands-off, self-propagating network attack. No authentication is required (PR:N), so the target victim need not be logged in, but a human must interact with the malicious link. The sources do not identify the exact vulnerable parameter, endpoint, or page, and the precise trigger is not described in the available sources beyond the reflected-XSS classification. Impact is limited to the victim's browser session (C:L/I:L, A:N). Exploitation is bounded to Kulga News Software versions from v26.7.4 up to (but not including) v26.10.0; upgrading to v26.10.0 removes the affected code per the advisory.

This is a moderate-severity reflected cross-site scripting flaw (CVSS 6.1) whose signals point to a low-to-moderate real-world priority rather than an urgent one. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates a network-reachable, low-complexity, unauthenticated flaw, but the UI:R metric means a victim must be tricked into clicking an attacker-crafted link, which materially reduces the likelihood of opportunistic mass exploitation. No EPSS score, no CISA KEV listing, and no proof-of-concept or exploit reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month' (not act_now or emergency), consistent with a flaw that warrants scheduled remediation rather than crisis response. The affected product, Kulga News Software from a single Turkish vendor, appears to be niche, which further limits aggregate exposure. No SSVC exploitation/automatable/technical-impact fields were provided, so that decision framework cannot be cross-referenced. Overall this reads as a genuine but contained issue - a reflected XSS requiring user interaction in a low-footprint product - rather than a high-CVSS, low-real-risk mislabel or a critical emergency.

An attacker crafts a malicious URL targeting a vulnerable Kulga News Software endpoint and delivers it to a user via phishing, a forum post, or a chat message. When the victim clicks the link, the injected script reflects back and executes in the victim's browser session, allowing session/cookie theft, content manipulation, or actions in the application's context. Exploitation requires that specific victim to interact with the link (UI:R), and no public exploit code is identified in the available sources.