CVE-2026-127285: Cairo-dock Glx-Dock href Attribute bg_forum.php cross site scripting
A flaw has been found in Cairo-dock Glx-Dock 3.4.0. The affected element is an unknown function of the file bgforum.php of the component href Attribute Handler. This manipulation of the argument f causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker remotely manipulates the f argument handled by the href Attribute Handler in bg_forum.php. Exploitation requires a user to interact with the attacker-controlled content.
Is public exploit code available?
Yes. The exploit has been published and may be used.
What should organizations do if they cannot obtain a vendor fix?
The available information indicates that the vendor did not respond to early disclosure contact. No workaround or fixed release is provided in the supplied data; restrict exposure to the affected component and avoid untrusted values reaching the f argument where possible.