Description

A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file ww_page.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T13:17:27.090Z",
  "pubdate": "2026-10-12T13:17:27.090Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in Cairo-dock Glx-Dock up to version 3.4.0. The vulnerability resides within the Query Parameter Handler component specifically affecting the file ww_page.php.\nThe flaw allows a remote, unauthenticated attacker to inject malicious client-side scripts into the web-based interface by manipulating the 'p' parameter.\nSuccessful exploitation results in the execution of arbitrary JavaScript within the context of the user's browser session. This can lead to session hijacking, unauthorized actions performed on behalf of the victim, or the exfiltration of sensitive information.\nThe vulnerability is currently public, and the vendor has remained unresponsive to disclosure attempts, increasing the risk of exploitation for users of affected versions.\nDefensive measures involve restricting input and hardening the deployment environment.",
  "technicalDetails": "The vulnerability is a reflected Cross-Site Scripting (XSS) flaw located in the Query Parameter Handler of the Cairo-dock Glx-Dock software. The root cause is the improper sanitization and validation of the 'p' URL parameter within the 'ww_page.php' file. The application fails to adequately encode or neutralize user-supplied input before reflecting it back to the client browser in the response body.\nThe exploitation flow begins when an attacker crafts a malicious URL containing a JavaScript payload within the 'p' parameter. When an unsuspecting user navigates to this crafted URL, the server-side logic in 'ww_page.php' processes the request and incorporates the attacker-supplied payload directly into the HTTP response. Because the application does not utilize appropriate output encoding (such as HTML entity encoding), the victim's browser interprets the injected string as executable script code.\nThis is a remotely exploitable vulnerability that does not require prior authentication. As a result, an attacker can target any user who interacts with the vulnerable interface. The exploit facilitates the execution of malicious scripts within the victim's security context, enabling the attacker to bypass Same-Origin Policy (SOP) restrictions related to the application domain.\nPost-exploitation impact includes the ability to steal session cookies, capture keystrokes, modify the Document Object Model (DOM) of the page to perform phishing, or redirect the user to malicious external sites. Given that the exploit is public and the vendor has not provided an official patch, the risk of automated scanning and exploitation remains elevated. There are no known secondary authorization requirements; the injection is processed directly by the web server handling the request to 'ww_page.php'.\nTechnical analysis confirms that the flaw is consistent with standard reflected XSS patterns where the application fails to distinguish between legitimate navigational data and malicious script injection vectors within the query string parameters."
}