CVE-2026-95166
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload.
Risk Assessment
An attacker can execute arbitrary script in the user's browser, potentially leading to session or credential theft.
Recommendation
Upgrade Bacularis to a version later than 6.5.1 or implement input validation and sanitization for the LabelFormat field.
Other vulnerabilities in Bacularis
See all- CVE-2026-95165Medium
Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.
- CVE-2026-88743Medium
Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags. The vulnerability allows injection of malicious code that is stored and executed in other users' browsers.
- CVE-2026-88742Medium
Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field. The vulnerability allows injection of malicious code that is stored and executed in other users' browsers.
Original NVD description (English source)
In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS