CVE-2026-38936
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains parameter.
Risk Assessment
An attacker can inject malicious JavaScript code that executes in the victim's browser, potentially leading to session theft, account takeover, or data leakage.
Recommendation
Immediately upgrade diskover-community to a version newer than 2.3.5 that includes the fix. Until then, validate and sanitize input for the namecontains parameter.
Other vulnerabilities in diskover-community
See all- CVE-2026-38935Medium
A reflected cross-site scripting (XSS) vulnerability exists in diskover-community version 2.3.5 and earlier. An attacker can inject malicious JavaScript code via the doctype parameter in public/view.php.
- CVE-2026-38934High
A Cross-Site Request Forgery vulnerability was found in diskover-community version 2.3.5 and earlier. This flaw allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php file.
Original NVD description (English source)
A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains parameter
Vulnerability data from NVD (NIST) · CISA KEV · EPSS