EUVD-2026-38450
GHSA-hm9m-vhgh-rq6m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No privileges required and network-reachable, but UI:R mandates victim interaction; S:C captures browser-context scope change inherent to reflected XSS with low C/I impact.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
1DescriptionCVE.org
DRIMO CMS is vulnerable to Reflected XSS via q parameter in searching functionality. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser.
Product is in End Of Life phase and will not receive any updates. However, deleting info.php file mitigates the vulnerability,
AnalysisAI
Reflected XSS in DRIMO CMS search functionality allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted URL containing a malicious payload in the q parameter. All versions are affected via the CPE wildcard (cpe:2.3:a:drimo:drimo_cms:*), and the product has been declared End of Life - no security patch will be issued. The sole vendor-acknowledged mitigation, confirmed by CERT-PL, is deletion of the info.php file; no public exploit code or KEV listing has been identified at time of analysis.
Technical ContextAI
DRIMO CMS is a PHP-based content management system (tagged PHP in CVE metadata, vendor at http://www.drimo.pl/cms). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting): user-supplied input in the q search parameter is reflected directly into the HTTP response without adequate output encoding or sanitization. This classic reflected XSS pattern allows injection of arbitrary HTML/JavaScript into the response page. The reference to info.php in the mitigation suggests that file plays a role in the vulnerable search rendering path. The CVSS 4.0 subsequent-system impact metrics (SC:L/SI:L) correctly model XSS: the vulnerable system (the CMS server) has no direct impact, but the victim's browser (subsequent system) suffers limited confidentiality and integrity effects.
RemediationAI
No vendor-released patch will be issued - DRIMO CMS has reached End of Life. The vendor-acknowledged and CERT-PL-confirmed mitigation is to delete the info.php file from the server, which removes the vulnerable search rendering path; note this may eliminate any diagnostic or informational functionality that file provides. Organizations still running DRIMO CMS should treat this as a forcing function to migrate to an actively maintained CMS. As supplemental compensating controls while migration is planned, a Web Application Firewall can be configured to block requests containing XSS payloads in the q parameter - though WAF bypass is possible and this is not reliable long-term. Restricting access to the search endpoint via network ACLs, authentication requirements, or IP allowlisting for known users would further reduce attacker reach. Full advisory is at https://cert.pl/posts/2026/06/CVE-2026-11772.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today