CVE-2026-12682
MediumCVSS 5.4Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 through 10092026. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
An attacker can inject malicious script that is stored and executed in other users' browsers, potentially leading to session or data theft. The risk affects all application users visiting infected pages.
Recommendation
Update LIBRID/LIBREF to a version later than 10092026 if available, or contact the vendor for a fix. Until a patch is released, consider implementing additional input filtering and monitoring for unusual scripts.
Other vulnerabilities in LIBRID/LIBREF
See all- CVE-2026-6285High
A weak password recovery mechanism vulnerability exists in Ankaref Innovation and Technology Inc. LIBRID/LIBREF, allowing password recovery exploitation. The issue affects versions from 2.01.0.2183 through 10092026.
- CVE-2026-12683Medium
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF from 2.01.0.2183 through 10092026. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.