OSCAL-GUI Reflected XSS via project parameter in oscal.php_CVE-2026-34416

5.1 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Description

OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious input through the project request parameter. Attackers can craft a malicious URL containing unsanitized input that breaks out of the JavaScript string and HTML attribute context in the body onload event handler to execute arbitrary scripts when the link is visited by a victim.

Basic Information

ID CVE-2026-34416

Source VulnCheck

Published Jun 9, 2026 at 20:59

Affected Product

Vendor brian-ruf

Product OSCAL-GUI

Affected Versions brian-ruf OSCAL-GUI 0

CWE Classification

CWE-79

References

{
    "lastseen": "",
    "description": "OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious input through the project request parameter. Attackers can craft a malicious URL containing unsanitized input that breaks out of the JavaScript string and HTML attribute context in the body onload event handler to execute arbitrary scripts when the link is visited by a victim.",
    "published": "2026-06-09T20:59:29.063Z",
    "modified": "2026-06-09T20:59:29.063Z",
    "type": "cve",
    "title": "OSCAL-GUI Reflected XSS via project parameter in oscal.php",
    "source": "VulnCheck",
    "references": "https://gist.github.com/cyberinforepo/5a8d369a005826b6b42bfeed9607c2dd\nhttps://www.vulncheck.com/advisories/oscal-gui-reflected-xss-via-project-parameter-in-oscal-php",
    "id": "CVE-2026-34416",
    "bulletinFamily": "",
    "cwe": [
        "CWE-79"
    ],
    "cvelist": null,
    "sourceData": "brian-ruf OSCAL-GUI 0",
    "sourceHref": "",
    "cvss": {
        "score": 5.1,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "OSCAL-GUI",
    "version": "0",
    "vendor": "brian-ruf",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}