Turkhotspot
Monthly
Reflected cross-site scripting in Loglama.net's TurkHotspot captive-portal software allows an attacker positioned on an adjacent network segment to inject script into a victim's browser session inside the portal context when the victim loads a crafted link. All versions up to and including those released as of 2026-10-02 are affected (CPE cpe:2.3:a:loglama.net:turkhotspot:*), and the assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 5.2) shows exploitation requires adjacent-network reachability plus victim interaction, with impact limited to low confidentiality and integrity effects and no availability impact. No public exploit identified at time of analysis, and because Loglama.net did not respond to the coordinated disclosure there is no vendor-released patch identified at time of analysis, leaving the flaw a moderate-severity concern whose real-world risk is tempered by the adjacency and user-interaction prerequisites.
Reflected cross-site scripting in Loglama.net's TurkHotspot captive-portal software allows an attacker positioned on an adjacent network segment to inject script into a victim's browser session inside the portal context when the victim loads a crafted link. All versions up to and including those released as of 2026-10-02 are affected (CPE cpe:2.3:a:loglama.net:turkhotspot:*), and the assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 5.2) shows exploitation requires adjacent-network reachability plus victim interaction, with impact limited to low confidentiality and integrity effects and no availability impact. No public exploit identified at time of analysis, and because Loglama.net did not respond to the coordinated disclosure there is no vendor-released patch identified at time of analysis, leaving the flaw a moderate-severity concern whose real-world risk is tempered by the adjacency and user-interaction prerequisites.