5.4
MediumCVSS 3.1 · from VulnCheck
CVE-2026-116212
Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL
Webasyst Framework · Cross-site scripting · CWE-79AffectedWebasyst Framework
FixNo fix listed yet.
PublishedOct 26, 13:08 · VulnCheck
ScoredOct 26 · 5.4 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inWebasyst Frameworkup to 4.4.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known