CVE-2026-112204: Reflected XSS in WidzialniCMS

Q: What user interaction is required for exploitation?

An attacker must prepare a malicious URL targeting the /index.php endpoint and convince a victim to open it. The JavaScript executes in the victim's browser after the URL is opened.

Q: What can an attacker do if exploitation succeeds?

The attacker can execute arbitrary JavaScript in the victim's browser. The description specifically notes that this could allow theft of session cookies.

Q: Which version contains the fix?

The issue has been fixed in WidzialniCMS version 2.5.

Published Nov 9, 2026

Updated

WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft.

This issue has been fixed in version 2.5.

Affected Software

1 affected component

WidzialniCMS WidzialniCMS<2.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WidzialniCMS to a version that resolves this vulnerability.
Fixed in 2.5

Event History

Nov 9, 2026

CVE Published

via MITRE·12:48 PM

Data Sourced

via MITRE·12:48 PM

DescriptionWeakness

Frequently Asked Questions

What user interaction is required for exploitation?

An attacker must prepare a malicious URL targeting the /index.php endpoint and convince a victim to open it. The JavaScript executes in the victim's browser after the URL is opened.

What can an attacker do if exploitation succeeds?

The attacker can execute arbitrary JavaScript in the victim's browser. The description specifically notes that this could allow theft of session cookies.

Which version contains the fix?

The issue has been fixed in WidzialniCMS version 2.5.

CVE-2026-112204: Reflected XSS in WidzialniCMS

Affected Software

Remediation

Event History

Frequently Asked Questions

What user interaction is required for exploitation?

What can an attacker do if exploitation succeeds?

Which version contains the fix?

Company

Resources

Contact

Frequently Asked Questions

What user interaction is required for exploitation?

What can an attacker do if exploitation succeeds?

Which version contains the fix?