Reflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in March 2026
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
The vulnerability affects ICTBroadcast, a software product from ICT Innovations, specifically its demo environment and login page. An attacker could exploit it by tricking a user into opening a crafted link, causing malicious scripts to run in the victim's web browser.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in the ‘login.php’ endpoint, where the ‘editForm[extension_username]’ parameter is reflected in the response without proper filtering. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser once the victim accesses the malicious URL.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- ICT Innovations ICT Innovations’ PHP-CGI/PHP-FPM configuration
fixed in March 2026