CVE-2025-26564

Summary

CVE-2025-26564 is a Cross-site Scripting (XSS) vulnerability affecting the kagla GNUCommerce software from version n/a through 1.5.4. The flaw stems from improper neutralization of user input during web page generation. An attacker can exploit this vulnerability by injecting malicious scripts into a web page, potentially stealing sensitive user information or taking control of user sessions. This issue poses a serious risk to organizations using the affected version of kagla GNUCommerce and highlights the importance of regularly applying security updates to protect against such threats.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.