EUVD-2026-45977
GHSA-5mm3-vwfv-9jwr
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L confirmed because poll submission requires a user account; S:C and UI:R because stored payload executes in other users' browsers; A:N as XSS carries no availability impact.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bifra Engineering Consulting Ltd. Q-smart NexT Poll allows Stored XSS.
This issue affects Q-smart NexT Poll: before 1.8.7.
AnalysisAI
Stored cross-site scripting in Bifra Engineering Consulting Ltd. Q-smart NexT Poll (all versions before 1.8.7) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into poll content that executes in the browsers of any user who subsequently views the affected page. The scope change (S:C in CVSS) indicates impact extends beyond the submitting user to other authenticated or unauthenticated viewers, enabling session hijacking, credential theft, or unauthorized actions performed in the victim's browser context. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize user-supplied data before it is rendered as HTML in a browser. In this case the flaw is of the stored (persistent) variant: attacker-controlled input is written to the application's data store via the poll submission mechanism and later reflected back into page output without proper encoding or escaping. The affected product is identified by CPE cpe:2.3:a:bifra_engineering_consulting_ltd.:q-smart_next_poll:*:*:*:*:*:*:*:* covering all versions up to but not including 1.8.7. The scope change (S:C) in the CVSS vector confirms the injected payload affects a security principal other than the attacker - specifically, other users' browser execution environments - which is the canonical behavior of stored XSS.
RemediationAI
Upgrade Q-smart NexT Poll to version 1.8.7 or later, which is the vendor-confirmed patched release per the TR-CERT advisory TR-26-0583 available at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0583. If immediate patching is not feasible, consider restricting poll submission access to trusted users only by tightening role-based access controls, which raises the effective privilege bar and reduces the attacker pool. As an additional compensating control, deploying a Content Security Policy (CSP) header that disallows inline script execution can prevent injected payloads from executing even if the stored content is not yet sanitized - note that CSP implementation may require application-level adjustments if the product relies on inline scripts for legitimate functionality. Review all existing poll entries for suspicious content as part of remediation, since stored payloads may already be present in the data store.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today