CVE-2026-16020: Stored XSS Fazile BACAK's DefterAsist Financial Advisor Platform
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fazile BACAK DefterAsist Financial Advisor Platform allows Stored XSS.
This issue affects DefterAsist Financial Advisor Platform: through 2026-10-27.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vector specifies PR:L, so an attacker needs low-level privileges or an authenticated account. The attack is network-reachable and has low attack complexity.
Does exploitation require another user to take an action?
Yes. The vector includes UI:R, indicating that user interaction is required. Because this is stored XSS, the malicious content must be rendered in a page that a user accesses.
What could successful exploitation affect?
The reported impact is low confidentiality and low integrity impact, with no availability impact. The scope is changed (S:C), meaning the impact can extend beyond the vulnerable component's authorization boundary.
Which releases are affected?
The issue is reported as affecting DefterAsist Financial Advisor Platform through 2026-10-27. The provided information does not identify a fixed release or mitigation.