Cairo-dock Glx-Dock EUVD-2026-97361

Exploitation requires that an application exposes the ww_page.php endpoint of Cairo-dock/Glx-Dock (≤ 3.4.0) and accepts the 'p' query parameter, which is reflected without sanitization. No authentication is required (PR:N), but the attack is LIMITED by mandatory user interaction (UI:P): a victim must be socially engineered into opening the attacker-crafted URL, and the payload executes only in that victim's browser session with low integrity impact - there is no server compromise or data-at-rest exposure. The product's rare, niche Linux-desktop deployment further constrains realistic targeting.

This is a moderate-to-low real-world priority despite being remotely reachable. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) describes a reflected cross-site scripting flaw that is network-accessible and requires no privileges but DOES require passive user interaction (UI:P) - a victim must open an attacker-crafted link. The scored impact is limited to low integrity (VI:L) with no confidentiality (VC:N) or availability (VA:N) effect, consistent with a self-contained XSS. The Exploit Maturity is E:P (proof-of-concept), and the description confirms 'the exploit is now public,' so publicly available exploit code exists - but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. The dominant risk-reducing factor is product prevalence: Cairo-dock/Glx-Dock is a niche Linux desktop application, and the affected 'ww_page.php' component is an obscure web page with a tiny footprint. Signals are mildly conflicting on one point: the product is a C/GTK desktop dock, yet the vulnerable artifact is a PHP file, implying the flaw is in an associated website/demo rather than the shipped desktop binary - verify the actual deployed component with the vendor. Net: a genuine, publicly-exploitable XSS, but the limited impact, required user interaction, and very small deployment base keep real-world risk low.

An attacker crafts a URL to the vulnerable ww_page.php endpoint with a malicious payload in the 'p' query parameter and lures a victim into clicking it (e.g., via email or chat). When the victim's browser loads the page, the unsanitized 'p' value is reflected into the response and the injected script executes in the victim's session context. A public proof-of-concept exploit for this reflected XSS already exists per the disclosure.