PT-2026-35445 · Projeqtor · Projeqtor

Noé Susset + 1 · Published 2026-04-27 · Updated 2026-04-27 · CVE-2026-41466

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ProjeQtor versions 7.0 through 12.4.3

Description A stored cross-site scripting issue exists in the checkValidHtmlText() function within Security.php. The function fails to properly sanitize user input because it only detects specific patterns and returns unsanitized strings without output encoding. This allows attackers to inject malicious payloads using alternative syntax, such as img tags with event handlers, which are then stored and executed in the browsers of users who view the affected content.

Recommendations Update to version 12.4.4. As a temporary workaround, restrict access to the checkValidHtmlText() function within Security.php to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-41466

Affected Products

Projeqtor

References · 8

• 🔥 https://gryfman.fr/cves/CVE-2026-41466 · Exploit
• 🔥 https://damiri.fr/en/cves/CVE-2026-41466 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41466 · Security Note
• https://twitter.com/CVEnew/status/2048852147354177818 · Twitter Post
• https://projeqtor.com · Note
• https://twitter.com/VulmonFeeds/status/2048829876820430861 · Twitter Post
• https://vulncheck.com/advisories/projeqtor-stored-xss-via-checkvalidhtmltext · Note
• https://t.me/CVEtracker/51960 · Telegram Post