{"id":"EM-20261109-ERPH","url":"https://cyber.eventmonitor.net/incident/EM-20261109-ERPH/widzialnicms-vulnerability-cve-2026-112204/","type":"cve","title":"WidzialniCMS Vulnerability (CVE-2026-112204)","subtitle":"CVE-2026-112204","subject":"CVE-2026-112204","status":"Developing","severity":"medium","affected":[],"headline":null,"born":"2026-11-09T12:48:56.000Z","firstSignal":"2026-11-09T10:55:00.000Z","lastSignal":"2026-11-09T12:48:56.000Z","updated":"2026-11-09T15:18:40.970Z","revision":1,"life":[{"status":"Born","at":"2026-11-09T12:48:56.000Z","why":"second independent source: C8 EU Vulnerability Database (EUVD)"},{"status":"Developing","at":"2026-11-09T12:48:56.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-09T10:55:00.000Z","what":"First signal: C17 CERT Polska"},{"at":"2026-11-09T12:48:56.000Z","what":"Born: second source, C8 EU Vulnerability Database (EUVD). Page EM-20261109-ERPH created."}],"stages":[{"name":"Disclosed","at":"2026-11-09T13:17:04.820Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-09T13:17:04.820Z","detail":"CVSS 5.1"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":"2026-11-09T10:55:00.000Z","detail":"1 government and CERT sources"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-09T10:55:00.000Z","source":"C17","sourceName":"CERT Polska","role":"Government","severity":2,"title":"Vulnerabilities in WidzialniCMS software","text":"CERT Polska coordinated disclosure of 4 vulnerabilities (CVE-2026-110468, CVE-2026-110469, CVE-2026-112204 and CVE-2026-112205) found in WidzialniCMS software.","url":"https://cert.pl/en/posts/2026/11/CVE-2026-110468/"},{"at":"2026-11-09T12:48:56.000Z","source":"C8","sourceName":"EU Vulnerability Database (EUVD)","role":"Database","severity":2,"title":"EUVD-2026-120046 / CVE-2026-112204 (score 5.1)","text":"WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft. This issue has been fixed in version 2.5.","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120046"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-09T13:17:04.820","score":5.1,"severity":"MEDIUM","desc":"WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft.\n\n\nThis issue has been fixed in version 2.5.","product":"","seen":1794237520970},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}