{"affected":[{"defaultStatus":"unaffected","product":"WidzialniCMS","source":"CNA: CERT-PL","vendor":"Fundacja Widzialni","versions":[{"lessThan":"2.5","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-112204","cwes":["CWE-79"],"description":"WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft.\n\n\nThis issue has been fixed in version 2.5.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.1,"severity":"medium","source":"CNA: CERT-PL","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0"}],"modifiedAt":1794228536104,"publishedAt":1794228536104,"references":[{"source":"CNA: CERT-PL","tags":["third-party-advisory"],"url":"https://cert.pl/posts/2026/11/CVE-2026-110468"},{"source":"CNA: CERT-PL","tags":["product"],"url":"https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175"}],"remediation":[],"revision":"95b970c92d7f99a08922ae76dbed100e295a93d9609ffeb27b51e67043ab5097","sources":[{"modifiedAt":1794228536104,"name":"CNA: CERT-PL","retrievedAt":1794229706288,"url":"https://www.cve.org/CVERecord?id=CVE-2026-112204"}],"ssvc":null,"status":"published","title":"Reflected XSS in WidzialniCMS","updatedAt":1794229706288}