SZB-06e89823f1
EUVD lists unauthenticated XSS in VikRentCar 1.4.9 and earlier
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- e4jvikwp
- Product
- VikRentCar
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-114305, as relayed in a Mastodon post, describes an unauthenticated cross-site scripting flaw in VikRentCar versions up to 1.4.9. The entry gives a CVSS v3.1 score of 7.1 and was last updated 2026-10-30.
If you use e4jvikwp
Update VikRentCar to a version later than 1.4.9 if the vendor has released one
Review booking and admin pages for injected scripts
Limit administrator logins to trusted devices until the fix is applied
What the sources say 1
· Mastodon: “Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.” Source