CVE-2026-112204
MediumCVSS 5.1Summary
WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare a URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g. session cookie theft. This issue has been fixed in version 2.5.
Risk Assessment
Reflected XSS allows an attacker to execute malicious script in the victim's browser context, potentially leading to session hijacking and theft of authentication data. Organizations using WidzialniCMS are exposed to phishing attacks and compromise of administrator accounts.
Recommendation
Upgrade WidzialniCMS to version 2.5 or later. Until the upgrade, consider implementing input filtering and security headers (CSP) to reduce XSS risk.
Other vulnerabilities in WidzialniCMS
See all- CVE-2026-112205Medium
WidzialniCMS is vulnerable to brute force protection bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker unlimited login attempts. The issue is fixed in version 2.5.
- CVE-2026-110469Critical
WidzialniCMS is vulnerable to unrestricted file upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any location on the server, leading to remote code execution.
- CVE-2026-110468Critical
WidzialniCMS is vulnerable to unrestricted file upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any location on the server, leading to remote code execution.
Original NVD description (English source)
WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft. This issue has been fixed in version 2.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS