PT-2026-3554 · Botble · Rathena+3

CVE-2026-1183 · Publicado 2026-01-20 · Atualizado 2026-01-20

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Botble products TransP, Athena, Martfury, and Homzen (affected versions not specified)

Description An HTML injection issue exists in multiple Botble products, including TransP, Athena, Martfury, and Homzen. This is due to insufficient validation of user-supplied data. The issue occurs when sending a request to the /search API endpoint using the q parameter. Successful exploitation allows for the injection of arbitrary HTML code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-1183

Produtos afetados

Rathena

Homzen

Martfury

Transp

Referências · 5

• https://twitter.com/VulmonFeeds/status/2013659644292395113 · Publicação no Twitter
• https://t.me/CVEtracker/42609 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-1183 · Nota de Segurança
• https://incibe.es/en/incibe-cert/notices/aviso/html-injection-multiple-botble-products · Nota
• https://twitter.com/CVEnew/status/2013591850679181347 · Publicação no Twitter