EUVD-2026-41527
GHSA-m2vv-wr2h-x573
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Reflected XSS requires no privileges or special configuration, scope changes as injected script affects browser context beyond the origin page, and mandatory user interaction (UI:R) limits attacker control over triggering.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency Destekz allows Reflected XSS.
This issue affects Destekz: through 02062026. NOTE: The vendor was contacted and it was learned that the product is not supported.
AnalysisAI
Reflected XSS in Destekz (all versions through 02062026) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in victim browsers by delivering crafted URLs containing unsanitized input. The CVSS scope change (S:C) confirms that successful exploitation can affect resources beyond the vulnerable application itself, such as the victim's browser session context. Critically, the vendor Raera has confirmed the product is end-of-life and unsupported, meaning no patch will ever be released and all deployed instances are permanently vulnerable. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Destekz is a web application product developed by Raera, an Ankara-based web design and digital advertising agency in Turkey. The vulnerability is classified as CWE-79 (Improper Neutralization of Special Elements Used in a Web Page - Cross-Site Scripting), specifically the reflected variant in which user-supplied input from HTTP requests is echoed back in server responses without proper sanitization or output encoding. The CPE string cpe:2.3:a:raera_-_ankara_web_design_and_digital_advertising_agency:destekz:*:*:*:*:*:*:*:* covers all versions with no upper version bound, reflecting total absence of a fixed release. The CVSS scope change (S:C) is consistent with reflected XSS mechanics, where injected scripts execute inside the victim browser and can access cookies, local storage, and DOM elements associated with the application origin, effectively escaping the vulnerable component's own security boundary.
RemediationAI
No vendor-released patch identified at time of analysis, and none is expected given the vendor's confirmed statement that Destekz is no longer supported. The primary recommended action is migrating away from Destekz to an actively maintained alternative, as the product will receive no future security updates. If immediate migration is not feasible, taking the Destekz application fully offline eliminates the attack surface and is the most reliable compensating control with no operational trade-off beyond service availability. Organizations that must keep the application running should deploy a Web Application Firewall with XSS detection and blocking rules targeting reflected input patterns; note that WAF rules require ongoing tuning and may introduce false positives blocking legitimate users. Network-level access restrictions limiting the application to known trusted IP ranges reduce exposure to the AV:N attack vector but do not eliminate it and may conflict with legitimate user access patterns. Refer to the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0488 for further context.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today