Kulga News Software
Monthly
Reflected cross-site scripting in Kulga News Software from v26.7.4 before v26.10.0 allows remote attackers to execute script in a victim's browser session when the victim opens an attacker-crafted URL, requiring user interaction but no authentication. The flaw is rated CVSS 6.1, with low confidentiality and integrity impact and no availability impact, and exploitation is limited to the victim's browser session. No public exploit identified at time of analysis; the vendor fix is v26.10.0.
Reflected cross-site scripting in Kulga News Software from v26.7.4 before v26.10.0 allows remote attackers to execute script in a victim's browser session when the victim opens an attacker-crafted URL, requiring user interaction but no authentication. The flaw is rated CVSS 6.1, with low confidentiality and integrity impact and no availability impact, and exploitation is limited to the victim's browser session. No public exploit identified at time of analysis; the vendor fix is v26.10.0.