CVE-2026-95165
UnknownSummary
Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.
Risk Assessment
An attacker can inject malicious script that executes in the victim's browser, potentially leading to session hijacking.
Recommendation
Upgrade Bacularis to a version later than 6.5.1 or implement proper input sanitization for the Organization name field.
Other vulnerabilities in Bacularis
See all- CVE-2026-95166Unknown
In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload.
- CVE-2026-88743Medium
Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags. The vulnerability allows injection of malicious code that is stored and executed in other users' browsers.
- CVE-2026-88742Medium
Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field. The vulnerability allows injection of malicious code that is stored and executed in other users' browsers.
Original NVD description (English source)
Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS