CVE-2026-18957
Received Received - Intake

Stored XSS in Menulux Portal

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: Computer Emergency Response Team of the Republic of Turkey

Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Menulux Software Inc. Menulux Portal allows Stored XSS. This issue affects Menulux Portal: before 20260903211448.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-18957
EUVD
EUVD-2026-71037

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
menulux_software_inc menulux_portal to 20260903211448 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Menulux Portal software. It allows attackers to inject malicious scripts into web pages that are then stored on the server and served to other users. The flaw exists due to improper neutralization of user input during web page generation.

Detection Guidance

Detection of this stored XSS vulnerability in Menulux Portal requires manual inspection of input fields and user-generated content areas. Check for improperly sanitized inputs in forms, comment sections, or profile fields. Use browser developer tools to inspect network requests and responses for unfiltered user input. Test with payloads like <script>alert(1)</script> in input fields to see if they are reflected without sanitization.

Impact Analysis

An attacker could exploit this to steal user sessions, redirect users to malicious sites, or perform actions on behalf of users. It primarily affects users who interact with the Menulux Portal, especially those with elevated privileges like administrators.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using the affected software may face compliance violations and potential fines.

Mitigation Strategies

Update Menulux Portal to version 20260903211448 or later to address the stored XSS vulnerability. Review and sanitize all user inputs to prevent malicious scripts. Implement a web application firewall to filter out XSS payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18957. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart