CVE-2026-5782

MediumCVSS 5.2/10Last modified Oct 5, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in MRV Technology Foreign Trade Ltd. Co. TurkHotspot allows Reflected XSS.

This issue affects TurkHotspot: through 2026-10-02. NOTE: The vendor was contacted and it was learned that the product is not supported.

Metrics

CVSS 3.1 5.2/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
MRV Technology Foreign Trade Ltd. Co.	TurkHotspot	<= 2026-10-02

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1245

Timeline

Published: Oct 2, 2026
Last modified: Oct 5, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-578218.1A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. Th CVE-2026-578226.5When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE pe CVE-2026-578255.7In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .CVE-2026-578266.8An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and C CVE-2026-578279.8Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to CVE-2026-578288.8Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Downloads is vulne CVE-2026-578296.1Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable CVE-2026-57837.6Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Beyaz Computer Software Design Industr CVE-2026-578309.1Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate CVE-2026-578318.7Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2 - The Joomla extension DP Calendar CVE-2026-578328.7Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 - The Joomla extension EDocman is vulnerable to a CVE-2026-578338.6Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unaut