EUVD-2026-42016
GHSA-mfw3-p4vm-vmhx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS with no auth required, user click needed, browser context changed; no server availability or confidentiality impact beyond session data.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows XSS Targeting HTML Attributes.
This issue affects Access Control System (GKS): before Version 2.
AnalysisAI
Reflected XSS in Armiya Information Technologies' Access Control System (GKS) allows unauthenticated remote attackers to inject script-bearing HTML attributes into web pages served by the application, executing arbitrary JavaScript in the context of a victim's browser. All versions prior to Version 2 are affected, as reported by TR-CERT via Turkey's national cybersecurity authority. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the low-complexity, no-privilege attack vector makes this straightforward to weaponize against authenticated users of the access control panel.
Technical ContextAI
CWE-80 describes improper neutralization of script-related HTML tags specifically manifesting as injection into HTML attribute contexts - for example, crafting values that close an attribute and inject event handlers such as onerror=, onmouseover=, or onload= within rendered markup. The affected product is identified by CPE cpe:2.3:a:armiya_information_technologies_ltd._co.:access_control_system_(gks):*:*:*:*:*:*:*:*, indicating all versions of the GKS web-based access control platform prior to Version 2. The application fails to sanitize or encode user-supplied input before reflecting it into HTML attribute positions in the page response. The CVSS Scope metric is Changed (S:C), reflecting that the injected script executes in the victim's browser security context rather than on the server, a hallmark of classic reflected or DOM-based XSS.
RemediationAI
The primary fix is to upgrade to Access Control System (GKS) Version 2 or later, which resolves the improper HTML attribute neutralization identified in this advisory. The TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0502 should be consulted for vendor-specific upgrade instructions. If immediate patching is not possible, compensating controls include deploying a Web Application Firewall (WAF) rule set targeting attribute-injection XSS patterns to block crafted requests before they reach the application - note this may generate false positives on legitimate URL parameters. Additionally, restricting the GKS administrative interface to internal networks or VPN-only access reduces the attack surface by limiting who can deliver a crafted link. Training operators not to click unsolicited links while authenticated to the panel is a low-cost procedural control but should not substitute for patching.
More in Access Control System Gks
View allInformation disclosure in Armiya Information Technologies' Access Control System (GKS) before Version 2 allows remote un
Stored cross-site scripting in Armiya Information Technologies' Access Control System (GKS) versions before 2 allows an
Reflected cross-site scripting in Armiya Information Technologies' Access Control System (GKS) before Version 2 allows a
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today