5.1Mittel
CVE-2026-25868MiniGal Nano <= 0.3.5 Reflected XSS via dir Parameter
Beschreibung
MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter. The application constructs $currentdir from user-controlled input and embeds it into an error message without output encoding, allowing an attacker to supply HTML/JavaScript that is reflected in the response. Successful exploitation can lead to execution of arbitrary script in a victim's browser in the context of the vulnerable application.
Schwachstellentyp (CWE):
CWE-79
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| gnu | nano | ≤ 0.3.5 | |
| MiniGal | MiniGal Nano | ≤ 0.3.5 | |
| rybber | minigal nano | ≤ 0.3.5 |
Referenzen und Patches
- https://web.archive.org/web/20180330004313/http://www.minigal.dk/minigal-nano.html productProduct
- https://sourceforge.net/projects/minigalnano/ productProduct
- https://www.vulncheck.com/advisories/minigal-nano-reflected-xss-via-dir-parameter third-party-advisoryThird Party Advisory
CPE-Treffer (NVD) (1)
cpe:2.3:a:rybber:minigal_nano:*:*:*:*:*:*:*:*≤ 0.3.5