Reflected XSS Vulnerability in WidzialniCMS
CVE-2026-112204

5.1MEDIUM

Key Information:

Vendor

Fundacja Widzialni

Status
Widzialnicms
Vendor
CVE Published:
9 November 2026

What is CVE-2026-112204?

WidzialniCMS is vulnerable to a reflected Cross-Site Scripting (XSS) issue in the /index.php endpoint. This vulnerability allows attackers to craft a malicious URL that, when accessed by an unsuspecting user, triggers arbitrary JavaScript execution in their browser. This can lead to critical security risks including session cookie theft. The issue has been addressed and resolved in version 2.5 of the product.

Affected Version(s)

WidzialniCMS 0 < 2.5

References

https://cert.pl/posts/2026/11/CVE-2026-110468
third-party-advisory
https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg...
product

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mikołaj Matuszewski (CERT.PL)
.