CVE-2026-72553 in ElkArte
الملخص
بحسب MITRE • 11/08/2026
A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cust_blurb and cust_locate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An attacker can craft a payload that executes in an administrator session, enabling session hijacking or privilege escalation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.