{"id":"CVE-2026-58205","revision":"c1d26e13d25749c9a109dc60acad9a57","records":[{"revision":"c1d26e13d25749c9a109dc60acad9a57","observedAt":"2026-10-27T23:45:55.339+00:00","statement":{"source":"cve-program","id":"CVE-2026-58205","aliases":[],"title":"GRR has a Reflected XSS issue","description":"GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0.","state":0,"publishedAt":"2026-10-27T22:26:14.705+00:00","modifiedAt":"2026-10-27T22:26:14.705+00:00","affected":[{"ecosystem":"Vendor product","name":"GRR","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"JeromeDevome\",\n                    \"product\": \"GRR\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.5.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","score":8.1,"severity":"HIGH"}],"references":["https://github.com/JeromeDevome/GRR/security/advisories/GHSA-r6x2-w38j-vvq2","https://github.com/JeromeDevome/GRR/commit/4ef77f91818215c1f8e0f06023d89257dfd61c68","https://github.com/JeromeDevome/GRR/tree/v4.5.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-58205","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-58205","identifiers":["CVE-2026-58205"]},"retained":false,"historicalAffected":[]}],"coverage":[]}