CVE-2026-38936

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-38936", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-07-05T16:15:38.473Z", "dateReserved": "2026-04-06T00:00:00.000Z", "datePublished": "2026-04-27T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-07-05T16:15:38.473Z"}, "descriptions": [{"lang": "en", "value": "A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains parameter"}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38936"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "references": [{"url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38936", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T17:42:05.597822Z", "id": "CVE-2026-38936", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T17:45:55.506Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-38936", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T17:42:05.597822Z"}}}], "references": [{"url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38936", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T17:43:33.067Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "http://diskover-community.com"}, {"url": "http://diskoverdata.com"}, {"url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38936"}], "descriptions": [{"lang": "en", "value": "A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains parameter"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-27T17:07:52.497Z"}}}, "cveMetadata": {"cveId": "CVE-2026-38936", "state": "PUBLISHED", "dateUpdated": "2026-04-27T17:45:55.506Z", "dateReserved": "2026-04-06T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-27T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains parameter"}], "id": "CVE-2026-38936", "lastModified": "2026-07-05T17:17:34.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-38936", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T17:42:05.597822Z", "version": "2.0.3"}}]}, "published": "2026-04-27T17:16:43.250", "references": [{"source": "cve@mitre.org", "url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38936"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38936"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.3.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "diskover", "vendor": "diskoverdata"}], "analysis": {"en": {"generated_at": "2026-04-28T13:19:10.029077+00:00", "value": {"mitigation_remediation": ["Upgrade diskover\u2011community to a version newer than 2.3.5 that includes input sanitization for the namecontains parameter.", "If an upgrade is not possible, modify the application to encode or otherwise filter the namecontains input before echoing it to the page to eliminate XSS.", "Restrict or require authentication for access to public/selectindices.php to reduce exposure to unauthenticated users.", "Deploy a web application firewall or similar filtering mechanism to detect and block reflected XSS payloads."], "summary": {"action": "Apply Update", "impact": "Reflected Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Any deployment of diskover\u2011community version 2.3.5 or earlier is affected. No additional vendor or product information is specified.", "description_and_impact": "The vulnerability is a reflected cross\u2011site scripting flaw in the namecontains parameter of diskover\u2011community's public/selectindices.php page. An attacker can embed arbitrary JavaScript that is executed in the victim's browser when the user accesses a crafted URL. The flaw is limited to client\u2011side code execution and is associated with CWE\u201179.", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, implying rare exploitation. Exploitation requires an attacker to supply malicious input via the namecontains parameter and persuade a user to visit the URL, so the primary vector is unauthenticated web traffic. It does not provide remote code execution or privilege escalation on the server."}}}}, "created": "2026-04-28T09:17:25.058257+00:00", "title": "Reflected XSS via namecontains Parameter in diskover\u2011community Public SelectIndices", "updated": "2026-04-28T13:30:32.085325+00:00", "vendors": ["diskoverdata", "diskoverdata$PRODUCT$diskover"]}