CVE-2026-13536
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile — higher than 20% of all known CVEs
Summary
A cross-site scripting vulnerability was found in GotoHTTP up to version 10.2 in the /reg.12x file via the sn parameter. The attack can be performed remotely and the exploit details have been publicly disclosed.
Risk Assessment
The risk involves remote execution of scripts in the victim's browser, potentially leading to session theft, redirects, or data leakage. The vendor considers it low severity, but the public exploit increases the attack surface.
Recommendation
Immediately block access to the /reg.12x file on the firewall or web server and monitor for vendor updates. Consider temporarily disabling functionality related to this endpoint.
Original NVD description (English source)
A vulnerability has been found in GotoHTTP up to 10.2. This issue affects some unknown processing of the file /reg.12x. The manipulation of the argument sn leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor explains: "We immediately removed unnecessary parameter echo from source code. However the URL in the issue description will never be used in browser nor exposed to user, so it will not bring secure problem in fact. So we don't upgrade server right now, it will be included in next version together with other features."