Librid Libref
Monthly
Password recovery exploitation in LIBRID/LIBREF (a library management platform by Turkish vendor Ankaref Innovation and Technology Inc.) allows unauthenticated remote attackers to compromise user accounts by abusing a weak forgotten-password mechanism (CWE-640). All versions from 2.01.0.2183 through the build dated 10092026 are affected, and no vendor patch exists - the vendor did not respond to TR-CERT's disclosure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the combination of no authentication required, low complexity, and no vendor patch sustains meaningful account-takeover risk for any publicly accessible deployment.
Stored cross-site scripting in LIBRID/LIBREF (versions 2.01.0.2183 through 10092026) by Ankaref Innovation and Technology Inc. allows low-privileged authenticated users to inject persistent malicious scripts that execute in victims' browsers when affected pages are viewed. The vulnerability carries a scope change, enabling a limited user account to compromise sessions of higher-privileged users such as administrators. The vendor did not respond to TR-CERT's disclosure, and no patch has been issued; no public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting in LIBRID/LIBREF (Ankaref Innovation and Technology Inc.) allows a low-privileged authenticated attacker to inject persistent malicious scripts that execute in the browsers of other users visiting affected pages. The vulnerability spans all versions from 2.01.0.2183 through build 10092026 and was disclosed by TR-CERT (advisory TR-26-1064). No vendor patch is available - the vendor did not respond to coordinated disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis.
Password recovery exploitation in LIBRID/LIBREF (a library management platform by Turkish vendor Ankaref Innovation and Technology Inc.) allows unauthenticated remote attackers to compromise user accounts by abusing a weak forgotten-password mechanism (CWE-640). All versions from 2.01.0.2183 through the build dated 10092026 are affected, and no vendor patch exists - the vendor did not respond to TR-CERT's disclosure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the combination of no authentication required, low complexity, and no vendor patch sustains meaningful account-takeover risk for any publicly accessible deployment.
Stored cross-site scripting in LIBRID/LIBREF (versions 2.01.0.2183 through 10092026) by Ankaref Innovation and Technology Inc. allows low-privileged authenticated users to inject persistent malicious scripts that execute in victims' browsers when affected pages are viewed. The vulnerability carries a scope change, enabling a limited user account to compromise sessions of higher-privileged users such as administrators. The vendor did not respond to TR-CERT's disclosure, and no patch has been issued; no public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting in LIBRID/LIBREF (Ankaref Innovation and Technology Inc.) allows a low-privileged authenticated attacker to inject persistent malicious scripts that execute in the browsers of other users visiting affected pages. The vulnerability spans all versions from 2.01.0.2183 through build 10092026 and was disclosed by TR-CERT (advisory TR-26-1064). No vendor patch is available - the vendor did not respond to coordinated disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis.