What is the CVSS score of CVE-2026-7498?

CVE-2026-7498 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of DernekWeb are affected by CVE-2026-7498?

DernekWeb versions through 30122025 contain a stored XSS vulnerability (CVSS 8.8) that allows unauthenticated attackers to inject persistent malicious scripts affecting all users who view compromised…

How to fix or mitigate CVE-2026-7498?

Within 24 hours: Identify all DernekWeb instances in production and inventory affected systems and user populations. Within 7 days: Implement input validation and output encoding controls on user-facing pages; restrict administrative access to content management functions; enable HTTP-only and Secure flags on session cookies; deploy Web Application Firewall (WAF) rules to detect and block script injection patterns targeting DernekWeb. Within 30 days: Conduct full source code review of DernekWeb custom implementations; establish monitoring for malicious script execution; contact vendor for patch timeline and prepare upgrade plan for version > 30122025 upon release.

DernekWeb CVE-2026-7498

EUVD-2026-30759 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-18 TR-CERT

GHSA-cw64-mj5p-2vxf

XSS Dernekweb

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 09:31 vuln.today

DescriptionCVE.org

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Information Technology Consulting and Organization Trade Ltd. Co. DernekWeb allows Stored XSS.

This issue affects DernekWeb: through 30122025.

AnalysisAI

Stored cross-site scripting (XSS) in DernekWeb through version 30122025 enables attackers to inject persistent malicious scripts that execute when victims view affected pages. The vulnerability requires no authentication to exploit but does require user interaction (viewing the compromised page). With a high CVSS score of 8.8 reflecting potential for high impact across confidentiality, integrity and availability, this represents a serious risk for organizations using this Turkish association management software.

Technical ContextAI

DernekWeb is a web-based association management system developed by Basamak Information Technology Consulting and Organization Trade Ltd. Co., commonly used by Turkish organizations. The vulnerability stems from CWE-79 (improper neutralization of input during web page generation), where user-supplied data is stored in the application database without proper sanitization and later rendered in web pages without adequate output encoding. This allows attackers to inject JavaScript or other client-side code that persists in the application.

RemediationAI

No vendor-released patch identified at time of analysis. The version identifier '30122025' appears to be a future date (December 30, 2025), suggesting this may be a disclosure timeline rather than an actual version number. Organizations should contact Basamak Information Technology directly for patch availability. As compensating controls until a patch is available, implement a Web Application Firewall (WAF) with XSS filtering rules, though this may block legitimate content containing angle brackets or JavaScript keywords. Additionally, implement Content Security Policy (CSP) headers to restrict inline script execution, noting this may break legitimate application functionality if the application relies on inline scripts.