EUVD-2026-42225
GHSA-5wr2-9gxx-hx7w
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Low-privilege auth is required to store the payload (PR:L), victim must view the page (UI:R), and script executes cross-boundary in victim browser (S:C); no availability impact applies.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Design Mediküm Web allows Stored XSS.
This issue affects Mediküm Web: through 08072026. NOTE: The vendor was contacted and it was learned that the product is not supported.
AnalysisAI
Stored cross-site scripting in Mediküm Web (by Webbeyaz Web Design) enables authenticated low-privilege attackers to persist malicious scripts that execute in the browsers of other users who view the affected pages. All versions through 08072026 are affected per the CVE scope, with the CVSS scope-change metric (S:C) confirming cross-boundary execution into victim browser sessions. Critically, the vendor has confirmed the product is no longer supported, meaning no patch will be issued - organizations still running this software have no vendor remediation path. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize or encode user-supplied data before it is embedded in HTML output rendered by a browser. In this stored variant, attacker input is persisted server-side (e.g., in a database) and injected into page content whenever subsequent users load the affected resource. The CPE string cpe:2.3:a:webbeyaz_web_design:mediküm_web:*:*:*:*:*:*:*:* identifies the affected product as the 'Mediküm Web' web application produced by Turkish vendor Webbeyaz Web Design - likely a healthcare-oriented web platform based on the product name ('mediküm' being a Turkish medical term). The CVSS vector's S:C (scope changed) component confirms the vulnerability crosses the application trust boundary into the victim's browser execution context, a hallmark of reflected or stored XSS where the injected script operates under the origin of the vulnerable application.
RemediationAI
No vendor-released patch exists and none will be forthcoming, as the vendor has confirmed the product is unsupported. The primary recommended remediation is migration away from Mediküm Web to a supported alternative. For organizations that cannot immediately decommission the application, specific compensating controls include: deploying a Web Application Firewall (WAF) with XSS filtering rules in blocking mode in front of the application to intercept stored payload delivery to victims (trade-off: sophisticated obfuscated payloads may bypass signature-based WAF rules); enforcing a strict Content-Security-Policy (CSP) response header (e.g., default-src 'self'; script-src 'none') to prevent inline script execution in victim browsers (trade-off: may break legitimate application JavaScript if the app relies on inline scripts); restricting access to the application to trusted network segments or VPN to limit the pool of potential authenticated attackers who can submit stored payloads; and auditing existing stored content for malicious script tags. The TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0518 should be consulted for any additional guidance issued by the reporting organization.
More in Medik M Web
View allSQL injection in Webbeyaz Web Design's Mediküm Web application (all versions through build 08072026) lets remote unauthe
Reflected XSS in Mediküm Web, a Turkish healthcare web application by Webbeyaz Web Design, enables unauthenticated remot
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today