CVE-2026-1444

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1444", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-01-26T14:53:34.103Z", "datePublished": "2026-01-26T21:32:05.930Z", "dateUpdated": "2026-02-23T08:58:35.112Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:58:35.112Z"}, "title": "iJason-Liu Books_Manager add_book_check.php cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "iJason-Liu", "product": "Books_Manager", "versions": [{"version": "298ba736387ca37810466349af13a0fdf828e99c", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This affects an unknown part of the file controllers/books_center/add_book_check.php. Such manipulation of the argument mark leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-01-26T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-01-26T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-01-28T13:04:29.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "y1fan (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.342873", "name": "VDB-342873 | iJason-Liu Books_Manager add_book_check.php cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.342873", "name": "VDB-342873 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.736968", "name": "Submit #736968 | https://github.com/iJason-Liu/Books_Manager Books_Manager 1.0 Stored XSS", "tags": ["third-party-advisory"]}, {"url": "https://blog.y1fan.work/2026/01/13/%E5%AD%98%E5%82%A8%E5%9E%8Bxss/", "tags": ["broken-link", "exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T21:41:24.830204Z", "id": "CVE-2026-1444", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T21:41:33.130Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1444", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-27T21:41:24.830204Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T21:41:29.518Z"}}], "cna": {"title": "iJason-Liu Books_Manager add_book_check.php cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "y1fan (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "iJason-Liu", "product": "Books_Manager", "versions": [{"status": "affected", "version": "298ba736387ca37810466349af13a0fdf828e99c"}]}], "timeline": [{"lang": "en", "time": "2026-01-26T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-01-26T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-01-28T13:04:29.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.342873", "name": "VDB-342873 | iJason-Liu Books_Manager add_book_check.php cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.342873", "name": "VDB-342873 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.736968", "name": "Submit #736968 | https://github.com/iJason-Liu/Books_Manager Books_Manager 1.0 Stored XSS", "tags": ["third-party-advisory"]}, {"url": "https://blog.y1fan.work/2026/01/13/%E5%AD%98%E5%82%A8%E5%9E%8Bxss/", "tags": ["broken-link", "exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This affects an unknown part of the file controllers/books_center/add_book_check.php. Such manipulation of the argument mark leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:58:35.112Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1444", "state": "PUBLISHED", "dateUpdated": "2026-02-23T08:58:35.112Z", "dateReserved": "2026-01-26T14:53:34.103Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-01-26T21:32:05.930Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Books_Manager", "vendor": "iJason-Liu", "versions": [{"status": "affected", "version": "298ba736387ca37810466349af13a0fdf828e99c"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This affects an unknown part of the file controllers/books_center/add_book_check.php. Such manipulation of the argument mark leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en iJason-Liu Books_Manager hasta 298ba736387ca37810466349af13a0fdf828e99c. Esto afecta una parte desconocida del archivo controllers/books_center/add_book_check.PHP. Tal manipulaci\u00f3n del argumento mark lleva a cross site scripting. El ataque puede ser lanzado remotamente. El exploit ha sido divulgado al p\u00fablico y puede ser usado. Este producto no usa versionado. Esta es la raz\u00f3n por la que la informaci\u00f3n sobre las versiones afectadas y no afectadas no est\u00e1 disponible."}], "id": "CVE-2026-1444", "lastModified": "2026-06-17T10:15:48.133", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1444", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T21:41:24.830204Z", "version": "2.0.3"}}]}, "published": "2026-01-26T22:15:54.377", "references": [{"source": "cna@vuldb.com", "url": "https://blog.y1fan.work/2026/01/13/%E5%AD%98%E5%82%A8%E5%9E%8Bxss/"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.342873"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.342873"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.736968"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T20:13:28.960768+00:00", "value": {"mitigation_remediation": ["Sanitize the incoming \"mark\" parameter and encode any output that includes this value (e.g., using htmlspecialchars) to mitigate CWE\u201179 XSS.", "Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted domains, limiting the impact of any residual XSS attempts.", "Deploy web application firewall rules that detect and block common XSS payload patterns, preventing malicious input from reaching the application logic.", "Validate that the \"mark\" value does not contain language\u2011specific injection constructs and escape any code that could be interpreted as a server\u2011side expression language to address CWE\u201194."], "summary": {"action": "Apply Mitigation", "impact": "Remote Cross\u2011Site Scripting that can cause arbitrary JavaScript to run in the victim\u2019s browser"}, "threat_synthesis": {"affected_systems": "The vulnerability affects any deployment of iJason\u2011Liu Books_Manager that contains the code matching or preceding the commit hash 298ba736387ca37810466349af13a0fdf828e99c. Because the product does not use a conventional versioning scheme, it is unclear whether subsequent revisions have addressed the flaw, so administrators should assume the vulnerability persists until confirmed otherwise.", "description_and_impact": "A flaw in the Books_Manager application\u2019s add_book_check.php controller allows an attacker to supply a crafted \"mark\" value that is rendered without proper sanitization, resulting in injected JavaScript that executes in the victim\u2019s browser. This is a client\u2011side injection (CWE\u201179) that can be leveraged to steal session cookies, deface content, or deliver secondary malware, but it does not provide direct access to the server.", "risk_and_exploitability": "The CVSS score of 4.8 indicates low severity, yet the flaw can be exploited remotely without authentication and is publicly disclosed. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA\u2019s KEV catalog, implying no large\u2011scale attacks yet. Nevertheless, remote attackers could target any unauthenticated user visiting the vulnerable page to execute malicious scripts, and the lack of an official vendor patch requires manual mitigations."}}}}, "created": "2026-01-27T09:03:09.999630+00:00", "updated": "2026-04-18T20:15:09.551520+00:00", "vendors": ["ijason-liu", "ijason-liu$PRODUCT$books_manager"]}