CVE-2026-85541
Received Received - Intake

Reflected XSS in DreamMaker Software

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: TWCERT/CC

Description
DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85541
EUVD
EUVD-2026-70983

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
interinfo dreammaker to 2.3 (inc)
interinfo javacomposer_server 2.3
interinfo baserver3 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85541 is a Reflected Cross-site Scripting (XSS) vulnerability in DreamMaker software by Interinfo. Authenticated remote attackers can inject and execute arbitrary JavaScript code in a user's browser by tricking them into visiting a malicious website.

Detection Guidance

Detecting this Reflected XSS vulnerability requires checking for vulnerable versions of DreamMaker or baServer3. Inspect network traffic for requests to /servlet/baServer3.class or interactions with DreamMaker components. Monitor browser console logs for unexpected JavaScript execution when accessing DreamMaker interfaces.

Impact Analysis

This vulnerability allows attackers to steal session cookies, perform actions on behalf of users, or redirect users to phishing sites. It requires an authenticated user to click a malicious link, making social engineering a key factor in exploitation.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized execution of JavaScript in user browsers. This may lead to data breaches, unauthorized access to sensitive information, or manipulation of user sessions, which are critical violations under these regulations.

Mitigation Strategies
  • Update DreamMaker to use Java Composer Server version 2.3 or later.
  • Disable or remove the baServer3 component if not required, either via whitelist restrictions or by deleting /servlet/baServer3.class.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85541. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart