PT-2026-48267 · Brian Ruf · Oscal-Gui

Philopentest + 1 · Publicado 2026-06-09 · Atualizado 2026-06-09 · CVE-2026-34416

NVD

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious input through the project request parameter. Attackers can craft a malicious URL containing unsanitized input that breaks out of the JavaScript string and HTML attribute context in the body onload event handler to execute arbitrary scripts when the link is visited by a victim.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-34416

Produtos afetados

Oscal-Gui

Referências · 3

• 🔥 https://gist.github.com/cyberinforepo/5a8d369a005826b6b42bfeed9607c2dd · Exploit
• https://vulncheck.com/advisories/oscal-gui-reflected-xss-via-project-parameter-in-oscal-php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-34416 · Nota de Segurança