tharooon/cve-2026-29971An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking or privilege escalation.
An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking or privilege escalation.
Reflected Cross-Site Scripting (XSS)
WebFileSys
2.31.1
A reflected cross-site scripting vulnerability exists in WebFileSys version 2.31.1. User-controlled input is reflected into HTML and JavaScript contexts without proper output encoding, allowing an attacker to execute arbitrary JavaScript in the victim's browser.
An attacker may exploit this issue by inducing a victim to interact with a crafted request or link. Successful exploitation can lead to:
Example payloads which worked: <IMG SRC="javascript:alert('XSS')", %3CScRiPt%3Ealert(1)%3C%2FsCriPt%3E, <%
CVE-2026-29971
Tharun Teja Chidurala
