EUVD-2026-42017
GHSA-qwf8-w6p9-q9vq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable injection point requires no auth (PR:N); victim must view stored payload (UI:R); scope changes as script runs in victim browser (S:C); no availability impact.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Stored XSS.
This issue affects Access Control System (GKS): before Version 2.
AnalysisAI
Stored cross-site scripting in Armiya Information Technologies' Access Control System (GKS) versions before 2 allows an unauthenticated network attacker to persist malicious scripts in the application, which execute in the browser of any user who views the affected page. The scope change (S:C) in the CVSS vector indicates the injected payload breaks out of the application's security context and operates within the victim's browser environment, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to encode or sanitize attacker-controlled data before it is written to a page and rendered by a browser. In the stored variant, malicious input is persisted server-side (in a database or file) and replayed to every subsequent visitor of the affected page - making it more dangerous than reflected XSS because no per-victim phishing link is required. The affected product, identified by CPE cpe:2.3:a:armiya_information_technologies_ltd._co.:access_control_system_(gks):*:*:*:*:*:*:*:*, is a web-based physical access control management platform. Access control management panels commonly expose forms for registering personnel, visitors, or access credentials - any such input point that lacks output encoding is a potential injection sink. The CVSS S:C (Scope Changed) metric confirms the payload executes outside the application's own origin, consistent with classic stored XSS behavior in a browser context.
RemediationAI
Upgrade Access Control System (GKS) to Version 2 or later, which is identified as the remediated release per the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0502. Vendor-released patch: Version 2. If an immediate upgrade is not feasible, restrict access to the GKS web interface to trusted internal networks or VPN only, reducing the attacker's ability to reach the injection point without authentication. Additionally, implement a Content Security Policy (CSP) header at the web application or reverse-proxy layer to limit script execution origins - note this is a compensating control and does not eliminate the root-cause injection flaw. Audit existing stored data in the application for previously injected payloads, as stored XSS may have been planted prior to patching.
More in Access Control System Gks
View allInformation disclosure in Armiya Information Technologies' Access Control System (GKS) before Version 2 allows remote un
Reflected XSS in Armiya Information Technologies' Access Control System (GKS) allows unauthenticated remote attackers to
Reflected cross-site scripting in Armiya Information Technologies' Access Control System (GKS) before Version 2 allows a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today