PT-2026-37167 · Wlc · Wlc

Fg0X0 · CVE-2026-42150 · Published 2026-04-24 · Updated 2026-05-12

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions wlc versions prior to 2.0.0

Description The HTML output format embeds API response data into HTML without proper escaping. This allows for cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, when the output is rendered in a web browser.

Recommendations Update to version 2.0.0. As a temporary workaround, avoid using the opt-in HTML output format.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42150

GHSA-GX2M-MCC2-R4P3

PYSEC-2026-2321

Affected Products

Wlc

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42150.json · Exploit
• https://github.com/WeblateOrg/wlc/commit/0f3e58f6d7457b05d48ef40f579a172c4c8b8469 · Patch
• https://github.com/WeblateOrg/wlc/pull/1327 · Patch
• https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42150 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42150 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42150 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2321 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42150 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42150 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42150 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gx2m-mcc2-r4p3 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42150 · Vendor Advisory
• https://github.com/WeblateOrg/wlc · Note
• https://github.com/WeblateOrg/wlc/releases/tag/2.0.0 · Note