CVE-2026-6841

MediumCVSS 6.1

Published: 21/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

Request Tracker is vulnerable to reflected XSS via the "Page" parameter in GET requests. An attacker can craft a URL that executes arbitrary JavaScript in the victim's browser. Affects versions 5.0.4-5.0.9 and 6.0.0-6.0.2.

Risk Assessment

An attacker can steal sessions or user data, and conduct phishing attacks within the application context.

Recommendation

Update Request Tracker to version 5.0.10 or 6.0.3. Sanitize the Page parameter.

Other vulnerabilities in Request Tracker

CVE-2025-9158Medium
The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. An attacker can send a crafted e-mail enabling JavaScript code execution in the context of the logged-in user. This vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.

Original NVD description (English source)

Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL that, when opened, results in arbitrary JavaScript execution in the victim’s browser. This vulnerability affects versions from 5.0.4 up to 5.0.9 and from 6.0.0 up to 6.0.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS