Reflected Cross-site Scripting Vulnerability in DreamMaker by Interinfo
CVE-2026-85541

4.8MEDIUM

Key Information:

Vendor

Interinfo

Status
Dreammaker
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85541?

The reflected cross-site scripting vulnerability in DreamMaker developed by Interinfo allows authenticated remote attackers to inject and execute arbitrary JavaScript code within a user's browser. This exposure can lead to significant security risks, enabling attackers to manipulate user sessions or redirect users to malicious sites, especially when users are misled into visiting a compromised link.

Affected Version(s)

DreamMaker all

References

https://www.twcert.org.tw/tw/cp-132-11183-06a5e-1.html
https://www.twcert.org.tw/en/cp-139-11184-9ad14-2.html

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.