OSCAL-GUI Reflected XSS via project parameter in oscal.php
CVE-2026-34416

5.1MEDIUM

Key Information:

Vendor

Brian-ruf

Status
Oscal-gui
Vendor
CVE Published:
9 June 2026

Badges

👾 Exploit Exists

What is CVE-2026-34416?

OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious input through the project request parameter. Attackers can craft a malicious URL containing unsanitized input that breaks out of the JavaScript string and HTML attribute context in the body onload event handler to execute arbitrary scripts when the link is visited by a victim.

Affected Version(s)

OSCAL-GUI 0

References

https://gist.github.com/cyberinforepo/5a8d369a005826b6b42...
technical-descriptionexploit
https://www.vulncheck.com/advisories/oscal-gui-reflected-...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

philopentest
VulnCheck
.