CVE Catalog
CVE-2026-28166
HighCVSS 7.1Summary
Unauthenticated Cross Site Scripting (XSS) vulnerability in Tourmaster versions up to 5.4.9.
Risk Assessment
An attacker can inject a malicious script that executes in the victim's browser, potentially leading to session theft or account takeover.
Recommendation
Update Tourmaster to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Tourmaster
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.