PT-2026-3554 · Botble · Rathena+3

Published 2026-01-20 · Updated 2026-01-20 · CVE-2026-1183

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Botble products TransP, Athena, Martfury, and Homzen (affected versions not specified)

Description An HTML injection issue exists in multiple Botble products, including TransP, Athena, Martfury, and Homzen. This is due to insufficient validation of user-supplied data. The issue occurs when sending a request to the /search API endpoint using the q parameter. Successful exploitation allows for the injection of arbitrary HTML code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1183

Affected Products

Rathena

Homzen

Martfury

Transp

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-1183 · Security Note
• https://twitter.com/VulmonFeeds/status/2013659644292395113 · Twitter Post
• https://t.me/CVEtracker/42609 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/html-injection-multiple-botble-products · Note
• https://twitter.com/CVEnew/status/2013591850679181347 · Twitter Post