CVE-2026-34907

MediumCVSS 5.1/10Last modified Jul 22, 2026

Description

Wirtualna Uczelnia is vulnerable to Reflected Cross‑Site Scripting (XSS) due to insecure handling of the locale parameter across multiple endpoints. An attacker can craft a malicious URL with JavaScript embedded in the locale parameter and send it to a victim. When the victim opens the link, the injected script will be executed in their browser.

This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545

Metrics

CVSS 4.0 5.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-3490810.0A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauth CVE-2026-3490910.0A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the u CVE-2026-3491010.0A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a CVE-2026-349117.7A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to ac CVE-2026-349124.3A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and CVE-2026-349134.3A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earl CVE-2026-349148.3A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploi CVE-2026-349156.1A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user t CVE-2026-349168.8A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user t CVE-2026-349174.3Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restrict CVE-2026-34926.4The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is CVE-2026-349266.7A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table