CVE-2026-8309
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A reflected XSS vulnerability was found in the Access Control System (GKS) by Armiya Information Technologies Ltd. Co. before version 2. The flaw is due to improper input neutralization during web page generation.
Risk Assessment
An attacker can inject a malicious script into the server response, potentially leading to session theft, redirection to malicious sites, or other actions in the victim's context.
Recommendation
Immediately update the Access Control System (GKS) to version 2 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Armiya Access Control System (GKS)
See all- CVE-2026-8306Medium
A stored Cross-Site Scripting (XSS) vulnerability exists in Armiya Information Technologies Ltd. Co. Access Control System (GKS) before version 2. The flaw is caused by improper neutralization of input during web page generation.
- CVE-2026-7380Medium
An XSS vulnerability in Armiya's Access Control System (GKS) allows an attacker to inject malicious scripts via HTML attributes. The issue affects versions prior to 2.0.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Reflected XSS. This issue affects Access Control System (GKS): before Version 2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS