CVE-2026-44956
UnknownCVSS 0.0Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Low-privileged users could use their Full Name as a vector for a stored XSS attack. The name is included in system-generated emails, whose content is stored in the details field of the userlog table.
Risk Assessment
An attacker could inject malicious JavaScript code that would be executed by an admin viewing the email content, potentially leading to data theft or account takeover.
Recommendation
It is recommended to implement proper output sanitization to prevent XSS attacks. Additionally, user logs should be monitored for potential attack attempts.
Original NVD description (English source)
Low‑privileged users could use their Full Name as a vector for a stored XSS attack. The name is included in system‑generated emails, whose content is stored in the details field of the userlog table. An admin user viewing the email content through userlog-details.php would have any malicious JavaScript payload executed due to missing output sanitisation. Proper escaping has been added to the userlog details output.