EUVD-2026-67723
GHSA-6h99-mp99-h46w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS requiring victim click; scope change to browser context; no availability impact; assessment consistent with reported vector.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ceviz Informatics Inc. Web Design allows Reflected XSS.
This issue affects Web Design: through 25082026.
AnalysisAI
Reflected XSS in Ceviz Informatics Inc.'s Web Design platform (versions through 25082026) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by tricking them into clicking a crafted URL. The CVSS scope change (S:C) confirms the injected script crosses the application-browser trust boundary, enabling session hijacking, credential theft, or malicious redirects. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Victim user interaction is required - the victim must click an attacker-crafted URL pointing to the vulnerable Web Design application (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 6.1 Medium (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects typical reflected XSS scoring. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No patch version is confirmed from the available data; organizations should consult the vendor (Ceviz Informatics Inc.) directly and review the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0943 for remediation guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today