EUVD-2026-41370
GHSA-887m-hc2v-7mwj
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-delivered stored XSS requiring a low-privilege authenticated write and victim page-view; scope change reflects payload executing in the victim's browser security context.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber Defense Inc. WAF-ASP allows Stored XSS.
This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117.
AnalysisAI
Stored XSS in TR7 Cyber Defense Inc.'s WAF-ASP web application firewall permits authenticated low-privilege attackers to inject persistent malicious scripts that execute in the browsers of other users - including administrators - who later view the affected page. Versions from v1.0.324.900 up to but not including v1.4.0.117 are confirmed affected. No public exploit code or CISA KEV listing exists at time of analysis; exploitation nonetheless requires only low-privilege credentials and a single victim page-view.
Technical ContextAI
WAF-ASP is a web application firewall product developed by TR7 Cyber Defense Inc., a Turkish cybersecurity vendor. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), stored variant - meaning attacker-controlled input is persisted in the application's backend and later rendered without adequate output encoding to other users' browsers. The CVSS scope change (S:C) confirms the injected script executes outside the attacker's own security context, crossing into the victim's browser session. The affected CPE is cpe:2.3:a:tr7_cyber_defense_inc.:waf-asp:*:*:*:*:*:*:*:*, covering versions in the v1.x line prior to v1.4.0.117.
RemediationAI
Upgrade WAF-ASP to v1.4.0.117 or later, which is the vendor-released patch version confirmed by the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0487. If immediate patching is not feasible, restrict access to the WAF-ASP management interface to trusted internal network segments only, reducing the pool of potential authenticated attackers who could submit stored payloads. Additionally, limit write access to input fields within the interface to the minimum necessary set of accounts, and implement session monitoring to detect unexpected privileged actions that may indicate XSS-based session hijacking. Note that network segmentation alone does not eliminate the risk if internal threat actors or compromised low-privilege accounts are present.
Authentication abuse in TR7 Cyber Defense WAF-ASP (versions v1.0.324.900 through v1.4.0.116) lets remote unauthenticated
DOM-Based cross-site scripting in TR7 Cyber Defense Inc.'s WAF-ASP product allows an authenticated low-privilege attacke
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today