CVE-2026-111877: dext34-morgan Books4Cash search.php cross site scripting
A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a manipulation of the argument Search can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker can target the vulnerable search.php functionality remotely by manipulating the Search argument. The published severity vector indicates no privileges are required, but user interaction is required for impact.
Which versions should be treated as affected?
Books4Cash versions up to commit a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571 are identified as affected. No fixed version or remediation commit is provided.
How practical is exploitation?
Public exploit information has been disclosed, and the issue is rated as low attack complexity. This makes exposed instances using the affected search functionality a realistic target, subject to convincing a user to interact with the crafted content.
What can be done if a patch is not available?
No vendor patch or workaround is provided in the available information. Because the vulnerable component is search.php and the affected input is Search, reducing or disabling access to that search functionality can limit exposure until the code can be remediated or replaced.