Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-58257 (GCVE-0-2026-58257)

Vulnerability from nvd – Published: 2026-10-27 22:34 – Updated: 2026-10-27 22:34

Title

GRR vulnerable to Arbitrary File Read and Deletion

Summary

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server, causing sensitive file disclosure and denial of service through file deletion. The impact is amplified when the server runs with elevated privileges. The advisory reports this issue as fixed in version 4.5.0.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7926 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/JeromeDevome/GRR/security/advi…	x_refsource_CONFIRM
https://github.com/JeromeDevome/GRR/commit/e1f93b…	x_refsource_MISC
https://github.com/JeromeDevome/GRR/tree/v4.5.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
JeromeDevome	GRR	Affected: < 4.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "GRR",
          "vendor": "JeromeDevome",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server, causing sensitive file disclosure and denial of service through file deletion. The impact is amplified when the server runs with elevated privileges. The advisory reports this issue as fixed in version 4.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T22:34:47.670Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/JeromeDevome/GRR/security/advisories/GHSA-p8vm-f8mr-q7w7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/JeromeDevome/GRR/security/advisories/GHSA-p8vm-f8mr-q7w7"
        },
        {
          "name": "https://github.com/JeromeDevome/GRR/commit/e1f93b08ae6ebbab3ddbcd6b900800c39fb048de",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JeromeDevome/GRR/commit/e1f93b08ae6ebbab3ddbcd6b900800c39fb048de"
        },
        {
          "name": "https://github.com/JeromeDevome/GRR/tree/v4.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JeromeDevome/GRR/tree/v4.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-p8vm-f8mr-q7w7",
        "discovery": "UNKNOWN"
      },
      "title": "GRR vulnerable to Arbitrary File Read and Deletion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-58257",
    "datePublished": "2026-10-27T22:34:47.670Z",
    "dateReserved": "2026-06-29T21:54:30.330Z",
    "dateUpdated": "2026-10-27T22:34:47.670Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58256 (GCVE-0-2026-58256)

Vulnerability from nvd – Published: 2026-10-27 22:32 – Updated: 2026-10-27 22:32

Title

GRR vulnerable to Remote Code Execution Via PHP Code Injection

Summary

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7926 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/JeromeDevome/GRR/security/advi…	x_refsource_CONFIRM
https://github.com/JeromeDevome/GRR/commit/3ff950…	x_refsource_MISC
https://github.com/JeromeDevome/GRR/tree/v4.5.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
JeromeDevome	GRR	Affected: < 4.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "GRR",
          "vendor": "JeromeDevome",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T22:32:12.589Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/JeromeDevome/GRR/security/advisories/GHSA-fp4f-xmw6-5jf8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/JeromeDevome/GRR/security/advisories/GHSA-fp4f-xmw6-5jf8"
        },
        {
          "name": "https://github.com/JeromeDevome/GRR/commit/3ff9504ae557da1e8e208149acbf8c7f04de645f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JeromeDevome/GRR/commit/3ff9504ae557da1e8e208149acbf8c7f04de645f"
        },
        {
          "name": "https://github.com/JeromeDevome/GRR/tree/v4.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JeromeDevome/GRR/tree/v4.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-fp4f-xmw6-5jf8",
        "discovery": "UNKNOWN"
      },
      "title": "GRR vulnerable to Remote Code Execution Via PHP Code Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-58256",
    "datePublished": "2026-10-27T22:32:12.589Z",
    "dateReserved": "2026-06-29T21:54:30.330Z",
    "dateUpdated": "2026-10-27T22:32:12.589Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58205 (GCVE-0-2026-58205)

Vulnerability from nvd – Published: 2026-10-27 22:26 – Updated: 2026-10-27 22:26

Title

GRR has a Reflected XSS issue

Summary

GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7926 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/JeromeDevome/GRR/security/advi…	x_refsource_CONFIRM
https://github.com/JeromeDevome/GRR/commit/4ef77f…	x_refsource_MISC
https://github.com/JeromeDevome/GRR/tree/v4.5.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
JeromeDevome	GRR	Affected: < 4.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "GRR",
          "vendor": "JeromeDevome",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim\u0027s browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T22:26:14.705Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/JeromeDevome/GRR/security/advisories/GHSA-r6x2-w38j-vvq2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/JeromeDevome/GRR/security/advisories/GHSA-r6x2-w38j-vvq2"
        },
        {
          "name": "https://github.com/JeromeDevome/GRR/commit/4ef77f91818215c1f8e0f06023d89257dfd61c68",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JeromeDevome/GRR/commit/4ef77f91818215c1f8e0f06023d89257dfd61c68"
        },
        {
          "name": "https://github.com/JeromeDevome/GRR/tree/v4.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JeromeDevome/GRR/tree/v4.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r6x2-w38j-vvq2",
        "discovery": "UNKNOWN"
      },
      "title": "GRR has a Reflected XSS issue"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-58205",
    "datePublished": "2026-10-27T22:26:14.705Z",
    "dateReserved": "2026-06-29T17:09:25.872Z",
    "dateUpdated": "2026-10-27T22:26:14.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58257 (GCVE-0-2026-58257)

Vulnerability from cvelistv5 – Published: 2026-10-27 22:34 – Updated: 2026-10-27 22:34

Title

GRR vulnerable to Arbitrary File Read and Deletion

Summary

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server, causing sensitive file disclosure and denial of service through file deletion. The impact is amplified when the server runs with elevated privileges. The advisory reports this issue as fixed in version 4.5.0.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7926 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/JeromeDevome/GRR/security/advi…	x_refsource_CONFIRM
https://github.com/JeromeDevome/GRR/commit/e1f93b…	x_refsource_MISC
https://github.com/JeromeDevome/GRR/tree/v4.5.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
JeromeDevome	GRR	Affected: < 4.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "GRR",
          "vendor": "JeromeDevome",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server, causing sensitive file disclosure and denial of service through file deletion. The impact is amplified when the server runs with elevated privileges. The advisory reports this issue as fixed in version 4.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T22:34:47.670Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/JeromeDevome/GRR/security/advisories/GHSA-p8vm-f8mr-q7w7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/JeromeDevome/GRR/security/advisories/GHSA-p8vm-f8mr-q7w7"
        },
        {
          "name": "https://github.com/JeromeDevome/GRR/commit/e1f93b08ae6ebbab3ddbcd6b900800c39fb048de",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JeromeDevome/GRR/commit/e1f93b08ae6ebbab3ddbcd6b900800c39fb048de"
        },
        {
          "name": "https://github.com/JeromeDevome/GRR/tree/v4.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JeromeDevome/GRR/tree/v4.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-p8vm-f8mr-q7w7",
        "discovery": "UNKNOWN"
      },
      "title": "GRR vulnerable to Arbitrary File Read and Deletion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-58257",
    "datePublished": "2026-10-27T22:34:47.670Z",
    "dateReserved": "2026-06-29T21:54:30.330Z",
    "dateUpdated": "2026-10-27T22:34:47.670Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58256 (GCVE-0-2026-58256)

Vulnerability from cvelistv5 – Published: 2026-10-27 22:32 – Updated: 2026-10-27 22:32

Title

GRR vulnerable to Remote Code Execution Via PHP Code Injection

Summary

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7926 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/JeromeDevome/GRR/security/advi…	x_refsource_CONFIRM
https://github.com/JeromeDevome/GRR/commit/3ff950…	x_refsource_MISC
https://github.com/JeromeDevome/GRR/tree/v4.5.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
JeromeDevome	GRR	Affected: < 4.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "GRR",
          "vendor": "JeromeDevome",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T22:32:12.589Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/JeromeDevome/GRR/security/advisories/GHSA-fp4f-xmw6-5jf8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/JeromeDevome/GRR/security/advisories/GHSA-fp4f-xmw6-5jf8"
        },
        {
          "name": "https://github.com/JeromeDevome/GRR/commit/3ff9504ae557da1e8e208149acbf8c7f04de645f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JeromeDevome/GRR/commit/3ff9504ae557da1e8e208149acbf8c7f04de645f"
        },
        {
          "name": "https://github.com/JeromeDevome/GRR/tree/v4.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JeromeDevome/GRR/tree/v4.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-fp4f-xmw6-5jf8",
        "discovery": "UNKNOWN"
      },
      "title": "GRR vulnerable to Remote Code Execution Via PHP Code Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-58256",
    "datePublished": "2026-10-27T22:32:12.589Z",
    "dateReserved": "2026-06-29T21:54:30.330Z",
    "dateUpdated": "2026-10-27T22:32:12.589Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58205 (GCVE-0-2026-58205)

Vulnerability from cvelistv5 – Published: 2026-10-27 22:26 – Updated: 2026-10-27 22:26

Title

GRR has a Reflected XSS issue

Summary

GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7926 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/JeromeDevome/GRR/security/advi…	x_refsource_CONFIRM
https://github.com/JeromeDevome/GRR/commit/4ef77f…	x_refsource_MISC
https://github.com/JeromeDevome/GRR/tree/v4.5.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
JeromeDevome	GRR	Affected: < 4.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "GRR",
          "vendor": "JeromeDevome",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim\u0027s browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T22:26:14.705Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/JeromeDevome/GRR/security/advisories/GHSA-r6x2-w38j-vvq2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/JeromeDevome/GRR/security/advisories/GHSA-r6x2-w38j-vvq2"
        },
        {
          "name": "https://github.com/JeromeDevome/GRR/commit/4ef77f91818215c1f8e0f06023d89257dfd61c68",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JeromeDevome/GRR/commit/4ef77f91818215c1f8e0f06023d89257dfd61c68"
        },
        {
          "name": "https://github.com/JeromeDevome/GRR/tree/v4.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JeromeDevome/GRR/tree/v4.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r6x2-w38j-vvq2",
        "discovery": "UNKNOWN"
      },
      "title": "GRR has a Reflected XSS issue"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-58205",
    "datePublished": "2026-10-27T22:26:14.705Z",
    "dateReserved": "2026-06-29T17:09:25.872Z",
    "dateUpdated": "2026-10-27T22:26:14.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities by JeromeDevome

CVE-2026-58257 (GCVE-0-2026-58257)

CVE-2026-58256 (GCVE-0-2026-58256)

CVE-2026-58205 (GCVE-0-2026-58205)

CVE-2026-58257 (GCVE-0-2026-58257)

CVE-2026-58256 (GCVE-0-2026-58256)

CVE-2026-58205 (GCVE-0-2026-58205)