CVE-2026-8315
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability has been found in Webbeyaz Web Design Mediküm Web due to improper input neutralization during web page generation. The issue affects versions up to 08072026, and the vendor has discontinued support for the product.
Risk Assessment
An attacker can inject malicious JavaScript code into application pages, potentially leading to session hijacking, account takeover, or sensitive data leakage. The lack of vendor support means this vulnerability will not be patched.
Recommendation
Immediately stop using Mediküm Web and replace it with a supported solution. If replacement is not possible, implement additional security measures such as a Web Application Firewall (WAF) and strict input filtering.
Other vulnerabilities in Mediküm Web
See all- CVE-2026-8307Critical
A SQL injection vulnerability was found in Webbeyaz Web Design Mediküm Web due to improper neutralization of special elements in SQL commands. This allows an attacker to execute arbitrary SQL queries on the database.
- CVE-2026-8310Medium
A reflected cross-site scripting (XSS) vulnerability has been found in Webbeyaz Web Design Mediküm Web due to improper input neutralization during page generation. The issue affects versions up to 08072026, and the vendor has discontinued support for the product.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webbeyaz Web Design Mediküm Web allows Stored XSS. This issue affects Mediküm Web: through 08072026. NOTE: The vendor was contacted and it was learned that the product is not supported.