Books4Cash CVE-2026-111877

Exploitation requires the specific search feature in search.php to receive attacker-controlled input via the 'Search' argument, which is reflected into the page without sanitization. Being reflected XSS, the attack is NOT fully unattended: a victim must follow an attacker-supplied link or submit an attacker-controlled form (CVSS UI:P), so social engineering/phishing is the delivery prerequisite. No authentication is required of the attacker (PR:N), and default configurations are affected since the search function is core application functionality. Practical limits: impact is confined to the victim's browser session (integrity-only, VI:L), there is no server-side code execution, and real-world reach is bottlenecked by the product's near-zero deployment base.

This is a reflected cross-site scripting flaw (CWE-79) in the abandoned open-source Books4Cash PHP application, reported by VulDB. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) scores 5.3 (medium) and indicates remote, unauthenticated, low-complexity attack but requiring passive user interaction (UI:P) and yielding only low integrity impact with no confidentiality or availability impact - consistent with a reflected XSS. Exploitation signals: publicly available exploit code exists (E:P / 'the exploit has been publicly disclosed'), but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. The strongest risk-dampening factor is real-world footprint: the vendor's own note that 'the code repository of the project has not been active for many years' plus the obscure dext34-morgan namespace indicate a hobby/retired project with negligible production deployment. Net: despite a public POC and a medium CVSS, this is a low real-world priority - the combination of required victim interaction, limited (integrity-only) impact, and a near-nonexistent install base outweighs the POC signal. No conflicting signals in the data, though the absence of EPSS/KEV should be read as 'not assessed/not listed,' not as confirmed safe.

An attacker crafts a URL to search.php containing a malicious payload in the 'Search' parameter and lures an authenticated or anonymous user of a Books4Cash instance into clicking it. When the victim's browser loads the page, the unsanitized Search value is reflected into the response and the injected script executes in the victim's session context, enabling session/cookie theft or UI manipulation. A public proof-of-concept exploit for this reflected XSS has been disclosed.