CVE-2026-39112
Stored XSS in Apartment Visitors Management System visname Parameter
Publication date: 2026-04-20
Last updated on: 2026-04-20
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| anuj_kumar | apartment_visitors_management_system | 1.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability is a Cross Site Scripting (XSS) issue in the visname parameter of visitors-form.php in Apartment Visitors Management System V1.1. Detection involves testing this parameter for injection of arbitrary JavaScript that executes when viewed in manage-newvisitors.php or visitor-detail.php.
To detect this vulnerability, you can manually test the visname parameter by injecting typical XSS payloads such as <script>alert(1)</script> and observing if the script executes when viewing the related pages.
Automated tools like Burp Suite or OWASP ZAP can be used to scan and test the visname parameter for XSS vulnerabilities.
Example command using curl to test the parameter (replace URL and parameters accordingly):
- curl -X POST -d "visname=<script>alert('XSS')</script>" http://target/visitors-form.php
Then, check the pages manage-newvisitors.php or visitor-detail.php to see if the injected script executes.
Can you explain this vulnerability to me?
This vulnerability is a Cross Site Scripting (XSS) issue found in the Apartment Visitors Management System version 1.1. It occurs in the visname parameter of the visitors-form.php file. An attacker who is authenticated can inject arbitrary JavaScript code into this parameter. This malicious code is then executed when the input is viewed later in the manage-newvisitors.php or visitor-detail.php pages.
How can this vulnerability impact me? :
The impact of this vulnerability includes the potential for an attacker to execute arbitrary JavaScript in the context of the affected application. This can lead to theft of user session data, defacement of the web pages, or redirection to malicious sites. Since the attacker must be authenticated, the risk is limited to users with some level of access, but the vulnerability can still compromise confidentiality and integrity of user data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a Cross Site Scripting (XSS) issue in the Apartment Visitors Management System that allows an authenticated attacker to inject arbitrary JavaScript. This can lead to unauthorized actions or data exposure when malicious scripts are executed in the context of a user's browser.
Such vulnerabilities can impact compliance with common standards and regulations like GDPR and HIPAA because they may lead to unauthorized access or disclosure of personal or sensitive data. XSS attacks can be used to steal session tokens, user credentials, or other sensitive information, potentially violating data protection requirements.
Therefore, the presence of this vulnerability could undermine the confidentiality and integrity of personal data managed by the system, which is critical for compliance with regulations that mandate protection of user data and privacy.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the Cross Site Scripting vulnerability in the Apartment Visitors Management System, ensure that all user inputs, especially the 'visname' parameter in visitors-form.php, are properly validated and sanitized.
- Implement input validation and sanitization to prevent injection of arbitrary JavaScript.
- Apply output encoding when displaying user-supplied data in manage-newvisitors.php or visitor-detail.php.
- Follow secure coding practices such as those recommended by OWASP to prevent XSS vulnerabilities.
Although specific mitigation steps for CVE-2026-39112 are not detailed in the resources, these general practices are effective against XSS vulnerabilities.