{"id":"CVE-2026-79315","published":"2026-09-22T15:17:15.777","lastModified":"2026-09-22T20:00:03.713","description":"A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the entities before the client-side framework evaluates the content as a JavaScript expression. A logged-in panel user who visits a crafted URL allows arbitrary script execution in the same-origin context of the management page, enabling data theft and unauthorized actions through the victim's session.","cvssScore":4.7,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79315.md","tags":[]},{"url":"https://github.com/vaxilu/x-ui","tags":[]}],"exploitRefs":[{"url":"https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79315.md","tags":[]},{"url":"https://github.com/vaxilu/x-ui","tags":[]}],"hasPoc":true,"ai":null}