CVE-2026-5738: Reflected XSS in BilPark's DoXBASE
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in BilPark Informatics Technologies Industry and Trade Inc. DoXBASE allows Cross Zone Scripting.
This issue affects DoXBASE: through 27082026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vector is network-based, requires no privileges, and has low attack complexity. A user must interact with attacker-controlled content, such as by following a crafted link or submitting a manipulated request.
What is the likely impact if exploitation succeeds?
The vulnerability can expose information and allow modification of data in another security zone or context. The published vector indicates no direct availability impact.
Which DoXBASE versions are affected?
The advisory states that DoXBASE is affected through 27082026. No fixed version or vendor remediation is provided in the available information.
Is a vendor patch available?
The available advisory does not identify a patch or other vendor response. It states that the vendor was contacted early but did not respond.