CVE-2026-66146
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser.
Risk Assessment
Executing JavaScript in the user's browser could lead to session theft, account takeover, or displaying fake content, potentially compromising trust in the system.
Recommendation
It is recommended to immediately update GMS to a version that includes fixes for XSS vulnerabilities. Also, implement input filtering and output encoding mechanisms in the application.
Original NVD description (English source)
Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser.