CVE-2026-97233

LowCVSS 3.5/10Last modified Oct 5, 2026

Description

A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument file_path leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Sep 24, 2026
Last modified: Oct 5, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-972357.1Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.CVE-2026-972366.5Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.CVE-2026-972377.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows CVE-2026-972385.5Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.CVE-2026-972396.5Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.CVE-2026-97244.3The MotorDesk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to m CVE-2026-972407.5Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.CVE-2026-972417.5Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.CVE-2026-972426.8Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.CVE-2026-972435.4Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.CVE-2026-972447.5Contributor Path Traversal in Creator LMS <= 1.2.19 versions.CVE-2026-972457.2Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.