EUVD-2026-42592
GHSA-j92g-m3p2-444q
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Low privilege to inject, victim must actively view page, scope change reflects cross-user script execution; no availability impact applicable.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Twiser Informatics Technology Consulting, Trade and Education Inc. OKRs & Goals allows Stored XSS.
This issue affects OKRs & Goals: from 28220 before 28398.
AnalysisAI
Stored XSS in Twiser OKRs & Goals (builds 28220 through pre-28398) allows authenticated low-privileged users to inject persistent malicious scripts that execute in other authenticated users' browsers. The CVSS scope change (S:C) confirms cross-user impact - a hallmark of stored XSS where one user's injected payload affects others who subsequently view the same content. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this firmly in standard patch-cycle priority.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied content is written to persistent storage without adequate sanitization and later rendered in HTML output without proper output encoding. The affected product, confirmed by CPE cpe:2.3:a:twiser_informatics_technology_consulting,_trade_and_education_inc.:okrs_&_goals, is an OKR (Objectives and Key Results) and goal-management web platform developed by Twiser Informatics Technology Consulting, a Turkish software vendor. Input fields such as goal titles, descriptions, key results, or comments are likely vectors for payload injection. The CVSS scope change (S:C) is technically explained by the browser's same-origin execution context - stored scripts execute under the victim's session, potentially accessing cookies, tokens, or permitting actions on behalf of the victim.
RemediationAI
Upgrade OKRs & Goals to build 28398 or later; this version boundary is stated explicitly in the CVE description as the fix threshold. Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0524 for additional vendor-specific guidance. If immediate patching is not operationally feasible, apply a strict Content Security Policy (CSP) header via a reverse proxy or WAF to restrict inline script execution - note this is a compensating control that may cause application breakage if the platform relies on inline JavaScript. Additionally, limiting platform access to a trusted internal user population reduces the attack surface by shrinking the pool of potential low-privileged injectors. Neither workaround eliminates the underlying injection flaw.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today