EUVD-2026-42224
GHSA-73vp-vhfv-cfq2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Reflected XSS requires no authentication (PR:N) but depends on victim loading a crafted URL (UI:R); S:C reflects script execution crossing into the browser context.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Design Mediküm Web allows Reflected XSS.
This issue affects Mediküm Web: through 08072026. NOTE: The vendor was contacted and it was learned that the product is not supported.
AnalysisAI
Reflected XSS in Mediküm Web, a Turkish healthcare web application by Webbeyaz Web Design, enables unauthenticated remote attackers to inject and execute malicious scripts in victims' browsers by tricking them into visiting a crafted URL. All versions through 08072026 are affected with no patch available or forthcoming, as the vendor has confirmed the product is end-of-life and unsupported. No public exploit code or active exploitation has been identified at time of analysis, but the permanent unpatched status makes decommissioning the only definitive remediation.
Technical ContextAI
Mediküm Web is a web application developed by Webbeyaz Web Design, likely targeting the Turkish healthcare sector based on naming. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), the canonical root cause of reflected XSS: user-supplied input is incorporated into HTTP responses without adequate sanitization or output encoding, allowing injected JavaScript to execute in the victim's browser under the application's origin. The CVSS Scope:Changed metric confirms the impact crosses from the server into the browser execution context. The CPE string cpe:2.3:a:webbeyaz_web_design:mediküm_web:*:*:*:*:*:*:*:* uses a wildcard version, indicating all known releases are affected through the reported cutoff date of 08072026. The advisory was published by TR-CERT (Turkish national CERT) and referenced at siberguvenlik.gov.tr.
RemediationAI
No vendor-released patch is available and none is expected, as the vendor has confirmed Mediküm Web is an unsupported, end-of-life product. The primary and only fully effective remediation is immediate decommissioning of all Mediküm Web instances and migration to a supported alternative. If decommissioning cannot be done immediately, deploy a web application firewall (WAF) configured with reflected XSS filtering rules as a temporary compensating control; note that WAF-based XSS filtering carries bypass risk and should not be treated as a permanent solution. Additionally, restrict network access to Mediküm Web to trusted internal segments to reduce the attacker's ability to distribute crafted URLs to authenticated user populations. Users of the application should be notified of the risk and advised not to follow unsolicited links to the system. The TR-CERT advisory is available at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0518.
More in Medik M Web
View allSQL injection in Webbeyaz Web Design's Mediküm Web application (all versions through build 08072026) lets remote unauthe
Stored cross-site scripting in Mediküm Web (by Webbeyaz Web Design) enables authenticated low-privilege attackers to per
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today