EUVD-2026-35841
GHSA-79q4-fp7f-qmxh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious content through the project request parameter in oscal-forms.php. The parameter value is URL-decoded and assigned to the project_id variable without sanitization in oscal-functions.php, and when the supplied project ID is not found, the unsanitized value is concatenated into an error message via the Messages() function and reflected into the HTML response body without encoding.
AnalysisAI
Reflected cross-site scripting in OSCAL-GUI allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting payloads through the unsanitized project parameter in oscal-forms.php. The parameter is URL-decoded and passed without sanitization into an error message via the Messages() function in oscal-functions.php, which is then reflected directly into the HTML response body when the supplied project ID does not match any existing record. A publicly available proof-of-concept exploit exists; the vulnerability is not confirmed in CISA KEV, and real-world impact is constrained by the CVSS UI:A requirement for victim interaction, making targeted phishing the primary delivery mechanism.
Technical ContextAI
OSCAL-GUI is a PHP-based web application by brian-ruf for managing OSCAL (Open Security Controls Assessment Language) content, covering all versions per the wildcard CPE cpe:2.3:a:brian-ruf:oscal-gui:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the reflected variant. The vulnerable code path begins in oscal-forms.php, which accepts a project request parameter, applies PHP URL-decoding, and assigns the result to the project_id variable. Control then passes to oscal-functions.php, where the Messages() function concatenates the raw, unsanitized project_id into an error string when no matching project record is found. This error string is written directly into the HTTP response body without HTML entity encoding (e.g., no htmlspecialchars() applied), allowing injected script tags or event-handler payloads to be parsed and executed by the victim's browser. The PHP tag taxonomy and the explicit URL-decode step indicate the application may have been attempting to handle legitimate project names with special characters, inadvertently widening the injection surface.
RemediationAI
No vendor-released patch has been identified at time of analysis; a fixed version is not confirmed from any available reference. The primary source-level fix requires applying htmlspecialchars() (with ENT_QUOTES and the correct character encoding) to the project_id variable before it is concatenated into the error message in oscal-functions.php, and validating or whitelisting the project parameter format in oscal-forms.php before URL-decoding. As a compensating control, administrators should restrict access to oscal-forms.php to authenticated users only via web server configuration (e.g., .htaccess or nginx auth_basic); this raises the effective attack bar despite the PR:N CVSS rating by requiring the attacker to first compromise valid credentials, though it introduces friction for legitimate unauthenticated use cases if any exist. Deploying a WAF rule to block common XSS patterns in the project parameter can reduce opportunistic risk but should not be treated as a reliable sole control, as WAF bypass techniques are well-documented. Monitor https://www.vulncheck.com/advisories/oscal-gui-reflected-xss-via-project-parameter-in-oscal-forms-php for patch availability updates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today