EUVD-2026-71101
GHSA-5fqf-rg4x-q9c6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS requiring victim click; scope change reflects browser context escape; C:L/I:L consistent with session theft and content manipulation only.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Content Spoofing.
This issue affects Library Information and Document Automation Program: from v22.1 before v22.2.
AnalysisAI
Cross-site scripting in Yordam Information Technology's Library Information and Document Automation Program enables unauthenticated network attackers to inject malicious scripts into pages served to authenticated library staff or patrons. Affected versions span v22.1 up to (but not including) v22.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required from the attacker (PR:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 score reflects a moderate-severity XSS with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, meaning the attack is network-reachable, low complexity, requires no prior authentication, but demands victim interaction (UI:R), limiting automated exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Library Information and Document Automation Program v22.2 or later, which resolves the XSS vulnerability per the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1011. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Open redirect exploitation in Yordam Informatics Technology's Library Information and Document Automation Program enable
Cross-site scripting in Yordam Information Technology's Library Information and Document Automation Program (all version
Unauthenticated SSRF in Yordam Informatics' Library Information and Document Automation Program allows remote attackers
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today