CVE-2026-12682: Stored XSS in Ankaref's LIBRID/LIBREF
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS.
This issue affects LIBRID/LIBREF: from 2.01.0.2183 through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
LIBRID/LIBREF versions from 2.01.0.2183 through 10092026 are identified as affected.
What access does an attacker need to exploit this issue?
The reported vector requires network access, low privileges, and user interaction. Exploitation involves storing malicious script content that is later rendered in a web page.
What impact can successful exploitation have?
The vulnerability is rated medium severity with low confidentiality and integrity impact, no availability impact, and changed scope. The published CVSS vector is 5.4.
Is a vendor fix or mitigation available?
The provided information does not identify a fix or workaround. It states that the vendor was contacted early about the disclosure but did not respond.