CVE-2026-8306
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A stored Cross-Site Scripting (XSS) vulnerability exists in Armiya Information Technologies Ltd. Co. Access Control System (GKS) before version 2. The flaw is caused by improper neutralization of input during web page generation.
Risk Assessment
An attacker can inject a malicious script that executes in the browsers of other users, potentially leading to session hijacking, account takeover, or data leakage.
Recommendation
Immediately upgrade the Access Control System (GKS) to version 2 or later, which contains the fix for this vulnerability.
Other vulnerabilities in Armiya Access Control System (GKS)
See all- CVE-2026-8309Medium
A reflected XSS vulnerability was found in the Access Control System (GKS) by Armiya Information Technologies Ltd. Co. before version 2. The flaw is due to improper input neutralization during web page generation.
- CVE-2026-7380Medium
An XSS vulnerability in Armiya's Access Control System (GKS) allows an attacker to inject malicious scripts via HTML attributes. The issue affects versions prior to 2.0.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Stored XSS. This issue affects Access Control System (GKS): before Version 2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS