What is the CVSS score of EUVD-2026-42016?

EUVD-2026-42016 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Access Control System GKS EUVD-2026-42016

| CVE-2026-7380 MEDIUM

Basic XSS (CWE-80)

2026-07-07 TR-CERT

GHSA-mfw3-p4vm-vmhx

XSS Access Control System Gks Armiya Information Technologies Ltd Co

6.1

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered reflected XSS with no auth required, user click needed, browser context changed; no server availability or confidentiality impact beyond session data.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 08:05 vuln.today

DescriptionCVE.org

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows XSS Targeting HTML Attributes.

This issue affects Access Control System (GKS): before Version 2.

AnalysisAI

Reflected XSS in Armiya Information Technologies' Access Control System (GKS) allows unauthenticated remote attackers to inject script-bearing HTML attributes into web pages served by the application, executing arbitrary JavaScript in the context of a victim's browser. All versions prior to Version 2 are affected, as reported by TR-CERT via Turkey's national cybersecurity authority. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the low-complexity, no-privilege attack vector makes this straightforward to weaponize against authenticated users of the access control panel.

Technical ContextAI

CWE-80 describes improper neutralization of script-related HTML tags specifically manifesting as injection into HTML attribute contexts - for example, crafting values that close an attribute and inject event handlers such as onerror=, onmouseover=, or onload= within rendered markup. The affected product is identified by CPE cpe:2.3:a:armiya_information_technologies_ltd._co.:access_control_system_(gks):*:*:*:*:*:*:*:*, indicating all versions of the GKS web-based access control platform prior to Version 2. The application fails to sanitize or encode user-supplied input before reflecting it into HTML attribute positions in the page response. The CVSS Scope metric is Changed (S:C), reflecting that the injected script executes in the victim's browser security context rather than on the server, a hallmark of classic reflected or DOM-based XSS.

RemediationAI

The primary fix is to upgrade to Access Control System (GKS) Version 2 or later, which resolves the improper HTML attribute neutralization identified in this advisory. The TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0502 should be consulted for vendor-specific upgrade instructions. If immediate patching is not possible, compensating controls include deploying a Web Application Firewall (WAF) rule set targeting attribute-injection XSS patterns to block crafted requests before they reach the application - note this may generate false positives on legitimate URL parameters. Additionally, restricting the GKS administrative interface to internal networks or VPN-only access reduces the attack surface by limiting who can deliver a crafted link. Training operators not to click unsolicited links while authenticated to the panel is a low-cost procedural control but should not substitute for patching.