CVE-2026-48118

Reflected XSS in the Comment module via the "statuscomment" URL parameter. The parameter accepts attacker-controlled base64-encoded HTML/JavaScript that is decoded server-side and rendered unescaped into the page. Compounded by a second flaw: the "checkss" anti-forgery token was derived from a...