PT-2026-45724 · Unknown · Wirtualna Uczelnia

CVE-2026-34907 · Published 2026-06-02 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Wirtualna Uczelnia versions prior to wu#2016.437.295#0#20260327 105545

Description Reflected Cross-Site Scripting (XSS) occurs due to insecure handling of the locale parameter across multiple endpoints. An attacker can craft a malicious URL containing JavaScript within the locale parameter; when a victim opens this link, the injected script executes in their browser.

Recommendations Update to a version newer than wu#2016.437.295#0#20260327 105545. Avoid using the locale parameter in affected endpoints until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-34907

Affected Products

Wirtualna Uczelnia

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-34907 · Security Note
• https://twitter.com/f1tym1/status/2061741995391963353 · Twitter Post
• https://t.me/CVEtracker/55590 · Telegram Post
• https://simple.com.pl/branze/edukacyjna · Note
• https://cert.pl/posts/2026/06/CVE-2026-34906 · Note