Cross-Site Scripting Vulnerability in Olivier-ls PHP-FTS Search Engine
CVE-2026-93956

5.1MEDIUM

Key Information:

Vendor

Olivier-ls

Status
PHP-fts
Vendor
CVE Published:
19 September 2026

What is CVE-2026-93956?

A cross-site scripting vulnerability exists in the SearchEngine::buildHighlights function found in the affected versions of Olivier-ls PHP-FTS. This flaw could be exploited by an attacker through the manipulation of the Query argument, leading to the execution of unauthorized scripts in a user's browser session. The vulnerability is exploitable remotely, which heightens the risk for users if left unaddressed. A patch has been developed and deployed in version 1.1.3 to mitigate this issue, emphasizing the importance of upgrading to maintain security and protect users from potential exploits.

Affected Version(s)

PHP-FTS 1.1.0

PHP-FTS 1.1.1

PHP-FTS 1.1.2

References

https://vuldb.com/vuln/407915
vdb-entrytechnical-description
https://vuldb.com/vuln/407915/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-93956
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

summmm (VulDB User)
VulDB CNA Team
.