CVE-2026-2102

MediumCVSS 6.1/10Last modified Nov 2, 2026

Description

wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Wren Securitywrensec-commons< 22.6.2; >= 23.0.0-M1, < 23.0.0

References

Timeline

Published
Nov 2, 2026
Last modified
Nov 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-210207.8Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged funcCVE-2026-210216.8Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.CVE-2026-210225.5Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive informaCVE-2026-210235.5Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify theCVE-2026-210246.3Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigger privileged functiCVE-2026-210255.5Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.CVE-2026-210265.5Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to senCVE-2026-210273.3Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging fCVE-2026-210285.5Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.CVE-2026-210297.8Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to executeCVE-2026-21037.8Infor SyteLine ERP uses hard-coded static cryptographic keys to encrypt stored credentials, including user passwords, database connection stCVE-2026-210307.8Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions.
CVE-2026-2102: Medium severity, CVSS 6.1 | Vulnix