What is the CVSS score of CVE-2026-5783?

CVE-2026-5783 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of CityPLus are affected by CVE-2026-5783?

Beyaz CityPLus application deployments (versions before V24.29750.1.0) contain a reflected cross-site scripting vulnerability allowing attackers to disrupt service availability and compromise user…

How to fix or mitigate CVE-2026-5783?

No vendor-released patch identified at time of analysis. Within 24 hours: Issue security alert to all CityPLus users and administrators; conduct inventory scan to identify all instances running versions before V24.29750.1.0; enable detailed request logging on CityPLus deployments. Within 7 days: Deploy or tune Web Application Firewall (WAF) rules to detect and block reflected XSS payloads targeting CityPLus parameters; enable Content Security Policy (CSP) headers if CityPLus deployment allows customization; subscribe to Beyaz security advisory channels. Within 30 days: Complete risk assessment prioritizing CityPLus instances by user population and business criticality; develop upgrade plan to CityPLus V24.29750.1.0 or later; integrate patch deployment into change management once vendor releases fix.

CityPLus CVE-2026-5783

EUVD-2026-31122 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-20 TR-CERT

GHSA-q787-v8vf-vc3c

XSS Cityplus

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 16:00 vuln.today

DescriptionCVE.org

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Beyaz Computer Software Design Industry and Trade Ltd. Co. CityPLus allows Reflected XSS.

This issue affects CityPLus: before V24.29750.1.0.

AnalysisAI

Reflected cross-site scripting in Beyaz Computer Software's CityPLus application (versions before V24.29750.1.0) allows remote attackers to inject malicious script into web responses that execute in a victim's browser after the victim clicks a crafted link. The CVSS 7.6 score is elevated by a High Availability impact, suggesting the XSS payload can crash or render the application unusable beyond typical session-theft outcomes. No public exploit identified at time of analysis and the issue was reported by TR-CERT (Turkey's national CERT).

Technical ContextAI

The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), the canonical root cause for XSS. CityPLus, identified by CPE cpe:2.3:a:beyaz_computer_software_design_industry_and_trade_ltd._co.:cityplus, is a web-based application produced by the Turkish vendor Beyaz Bilgisayar; the reflected variant indicates that user-supplied input (typically via query string or form parameter) is echoed back into the rendered HTML response without sufficient encoding or sanitization, allowing attacker-controlled script to execute in the browsing context of any user who follows a malicious link.

RemediationAI

Upgrade CityPLus to version V24.29750.1.0 or later, which is the fixed release identified in the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0263). Until the upgrade is deployed, deploy a web application firewall ruleset that blocks common reflected-XSS payload patterns (script tags, javascript: URIs, event handlers) on CityPLus request parameters, and enforce a strict Content-Security-Policy response header disallowing inline scripts to reduce execution impact - note that aggressive CSP rules may break legitimate CityPLus client-side functionality and should be tested first. User-awareness training to avoid clicking unsolicited CityPLus links from untrusted sources is a complementary control given the UI:R requirement.