CVE-2026-5783

HighCVSS 7.6/10Last modified Jul 23, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Beyaz Computer Software Design Industry and Trade Ltd. Co. CityPLus allows Reflected XSS.

This issue affects CityPLus: before V24.29750.1.0.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 20, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-578309.1Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate CVE-2026-578318.7Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2 - The Joomla extension DP Calendar CVE-2026-578328.7Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 - The Joomla extension EDocman is vulnerable to a CVE-2026-578338.6Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unaut CVE-2026-5783410.0Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 th CVE-2026-57848.8Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies In CVE-2026-578427.0NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a CVE-2026-578435.5NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local users to obtain real CVE-2026-578458.8Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python cod CVE-2026-578485.5Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the device via the android.in CVE-2026-57858.1Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authen CVE-2026-578508.3RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a limited session type