Description

Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-24T12:16:53.127Z",
  "pubdate": "2026-08-24T12:16:53.127Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in Urna versions <= 2.6.2. This vulnerability allows remote, unauthenticated attackers to inject malicious client-side scripts, typically JavaScript, into web pages rendered by the application and viewed by other users. The security implications include potential session hijacking, credential theft, redirection to malicious destinations, and unauthorized execution of actions within the context of the victim's browser session. The risk level is significant due to the lack of authentication requirements, enabling arbitrary external threat actors to target system users directly via network-exposed endpoints. Exploitation relies on the application failing to properly sanitize or encode user-supplied input before reflecting it back in the Document Object Model (DOM). No advanced privileges are required to deliver the payload, making it an accessible vector for automated or targeted client-side exploitation.",
  "technicalDetails": "The vulnerability stems from insufficient input sanitization and output encoding within Urna versions <= 2.6.2. Specifically, the application accepts unauthenticated HTTP requests containing malicious payloads and reflects this data back into the Hypertext Markup Language (HTML) response without adequate contextual output escaping.\nThe attack vector is network-based and does not require any prior authentication or authorization privileges. An unauthenticated attacker crafts a malicious Uniform Resource Locator (URL) or submits an HTTP request containing malicious script tags or event handlers, such as <script> or onerror directives, targeted at vulnerable application parameters or endpoints.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies a vulnerable parameter within the Urna application that reflects user input back into the HTTP response. Second, the attacker crafts an exploit payload containing malicious JavaScript. Third, the attacker delivers this payload to a victim via a crafted link or direct HTTP request. Fourth, when the victim's browser processes the server response, the unescaped payload is parsed as executable code within the Document Object Model (DOM). Finally, the script executes within the security context of the victim's browser session, allowing the attacker to access sensitive session tokens, cookies, or perform unauthorized actions on behalf of the user."
}