CVE-2026-11757

MediumCVSS 6.1/10Last modified Sep 18, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Website allows Reflected XSS.

This issue affects Bar Association Website: through 18092026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
KA Informatics Technologies Ltd. Co.Bar Association Website<= 18092026

References

Timeline

Published
Sep 18, 2026
Last modified
Sep 18, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1175705.2Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that letsCVE-2026-1175718.8The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visCVE-2026-1175724.1The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL CVE-2026-1175737.8hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting CVE-2026-1175749.1A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request sCVE-2026-1175884.3The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configuraCVE-2026-11769.8A security flaw has been discovered in itsourcecode School Management System 1.0. Affected is an unknown function of the file /subject/indexCVE-2026-1176017.5Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to rCVE-2026-1176028.4Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module wheCVE-2026-1176034.3Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients toCVE-2026-1176047.5Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated vCVE-2026-1176054.3nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellPro
CVE-2026-11757: Medium severity, CVSS 6.1 | Vulnix