CVE-2026-34907

MediumCVSS 5.1

Published: 02/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

Risk Assessment

An attacker can execute arbitrary JavaScript in the victim's context, potentially leading to session theft, redirection to malicious sites, or data theft.

Recommendation

Update Wirtualna Uczelnia to a version later than wu#2016.437.295#0#20260327_105545 or apply proper output encoding for the locale parameter.

Other vulnerabilities in Wirtualna Uczelnia

CVE-2026-34906Critical
In Wirtualna Uczelnia up to version wu#2016.437.295#0#20260327_105545, a Server-Side Template Injection (SSTI) vulnerability in the redirectToUrl endpoint allows an unauthenticated attacker to achieve remote code execution, including a reverse shell.

Original NVD description (English source)

Wirtualna Uczelnia is vulnerable to Reflected Cross‑Site Scripting (XSS) due to insecure handling of the locale parameter across multiple endpoints. An attacker can craft a malicious URL with JavaScript embedded in the locale parameter and send it to a victim. When the victim opens the link, the injected script will be executed in their browser. This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545

Vulnerability data from NVD (NIST) · CISA KEV · EPSS