Glx Dock
Monthly
Reflected cross-site scripting in Cairo-dock Glx-Dock through version 3.4.0 lets remote attackers execute arbitrary script in a victim's browser by crafting a URL that passes malicious input to the 'p' query parameter handled by ww_page.php. Exploitation requires no authentication but depends on a victim being socially engineered into opening the crafted link (UI:P), and the resulting impact is limited to low-integrity manipulation of that user's session with no server compromise or data-at-rest exposure. The vulnerability is rated CVSS 5.3 with a CVSS 4.0 exploit-maturity value of E:P, and publicly available exploit code exists; the vendor was contacted early but did not respond. Given the niche Linux desktop deployment of Glx-Dock and the mandatory user interaction, this is a moderate-to-low real-world priority despite being remotely reachable.
Reflected cross-site scripting in Cairo-dock Glx-Dock through version 3.4.0 lets remote attackers execute arbitrary script in a victim's browser by crafting a URL that passes malicious input to the 'p' query parameter handled by ww_page.php. Exploitation requires no authentication but depends on a victim being socially engineered into opening the crafted link (UI:P), and the resulting impact is limited to low-integrity manipulation of that user's session with no server compromise or data-at-rest exposure. The vulnerability is rated CVSS 5.3 with a CVSS 4.0 exploit-maturity value of E:P, and publicly available exploit code exists; the vendor was contacted early but did not respond. Given the niche Linux desktop deployment of Glx-Dock and the mandatory user interaction, this is a moderate-to-low real-world priority despite being remotely reachable.