CVE-2026-12682
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
LIBRID/LIBREF by Ankaref Innovation and Technology Inc. has a stored XSS vulnerability due to improper input neutralization during web page generation. Affects versions from 2.01.0.2183 before 18.9.26.2319.
Risk Assessment
An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft or other attacks.
Recommendation
Update LIBRID/LIBREF to version 18.9.26.2319 or later, which includes the fix.
Other vulnerabilities in LIBRID/LIBREF
See all- CVE-2026-6285High
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Password Recovery Exploitation. This issue affects LIBRID/LIBREF from 2.01.0.2183 before 18.9.26.2319.
- CVE-2026-12683Medium
LIBRID/LIBREF by Ankaref Innovation and Technology Inc. has a stored XSS vulnerability due to improper input neutralization during web page generation. Affects versions from 2.01.0.2183 before 18.9.26.2319.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS