Stored XSS Vulnerability in Userlog Details for Web Applications by Vendor

CVE-2026-44956

What is CVE-2026-44956?

A vulnerability exists that allows low-privileged users to exploit their Full Name as a vector for a stored Cross-Site Scripting (XSS) attack. This occurs when the user's name is included in system-generated emails, which are then stored in the userlog table. If an administrator views the email content via userlog-details.php, any embedded malicious JavaScript payload could execute due to a lack of output sanitisation. Proper escaping has now been implemented in the userlog details output to mitigate this risk.

References