SecvalisbySYSDEVOPS.EU
CVE Catalog
EnglishPolski

CVE-2026-28166

HighCVSS 7.1
Published: Updated: Translated: NVD NIST

Exploitation Probability (EPSS)

Low risk
0.25%

15th percentile - higher than 15% of all known CVEs

Summary

Unauthenticated Cross Site Scripting (XSS) vulnerability in Tourmaster versions up to 5.4.9.

Risk Assessment

An attacker can inject a malicious script that executes in the victim's browser, potentially leading to session theft or account takeover.

Recommendation

Update Tourmaster to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in Tourmaster

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS