PT-2026-5728 · Talishar · Talishar

Bxsic-Fr · Published 2026-02-02 · Updated 2026-02-03 · CVE-2026-25144

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Talishar (affected versions not specified)

Description A Stored Cross-Site Scripting (XSS) issue exists within the in-game chat system. The playerID parameter in the 'SubmitChat.php' file is saved without proper sanitization. This unsanitized data is then executed when a user views the current game page. This allows for the injection of malicious scripts into the chat system, potentially affecting users who view the compromised chat messages.

Recommendations Versions prior to the commit 09dd00e5452e3cd998eb1406a88e5b0fa868e6b4 are vulnerable.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25144

GHSA-RRR4-H2PC-57G6

Affected Products

Talishar

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25144.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-25144 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25144 · Security Note
• https://github.com/Talishar/Talishar/security/advisories/GHSA-rrr4-h2pc-57g6 · Note
• https://github.com/Talishar/Talishar/commit/09dd00e5452e3cd998eb1406a88e5b0fa868e6b4 · Note
• https://twitter.com/VulmonFeeds/status/2018484290049233390 · Twitter Post
• https://twitter.com/CVEnew/status/2018465507012206633 · Twitter Post