CVE-2026-12683
MediumCVSS 5.4Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF from 2.01.0.2183 through 10092026. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
An attacker can inject a malicious script that is stored and executed in other users' browsers, potentially leading to session theft, data theft, or unauthorized actions in the victim's context.
Recommendation
No vendor patch is available — implement your own input and output sanitization mechanisms and consider restricting access to the application. Monitor vendor communications for an update.
Other vulnerabilities in LIBRID/LIBREF
See all- CVE-2026-6285High
A weak password recovery mechanism vulnerability exists in Ankaref Innovation and Technology Inc. LIBRID/LIBREF, allowing password recovery exploitation. The issue affects versions from 2.01.0.2183 through 10092026.
- CVE-2026-12682Medium
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 through 10092026. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.