CVE-2026-12683: Stored XSS Yönetim panel in Ankaref's LIBRID/LIBREF

Q: Which deployments should be prioritized for review?

Deployments of Ankaref LIBRID/LIBREF running versions from 2.01.0.2183 through 10092026 should be reviewed, particularly where users with authenticated access can submit data that is later displayed in the management panel.

Q: What does exploitation require?

The vulnerability is remotely reachable and has low attack complexity, but an attacker needs low-level privileges and user interaction. Successful exploitation can affect confidentiality and integrity across a changed scope.

Q: Is a vendor fix or workaround available?

The available information does not identify a fix or workaround. It states that the vendor was contacted early about the disclosure but did not respond.

Published Sep 10, 2026

Updated

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS.

This issue affects LIBRID/LIBREF: from 2.01.0.2183 through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

Ankaref Innovation and Technology Inc. LIBRID/LIBREF>=2.01.0.2183<=10092026

Event History

Sep 10, 2026

CVE Published

via MITRE·01:23 PM

Data Sourced

via MITRE·01:23 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments should be prioritized for review?

Deployments of Ankaref LIBRID/LIBREF running versions from 2.01.0.2183 through 10092026 should be reviewed, particularly where users with authenticated access can submit data that is later displayed in the management panel.

What does exploitation require?

The vulnerability is remotely reachable and has low attack complexity, but an attacker needs low-level privileges and user interaction. Successful exploitation can affect confidentiality and integrity across a changed scope.

Is a vendor fix or workaround available?