CVE-2026-116212

Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in...

EUVD-2026-109804

Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in...

CVE-2026-116212

The Webasyst Framework (through version 4.4.0 ) contains a stored cross-site scripting (XSS) vulnerability within the Photos app . Authenticated backend users with album edit rights can inject malicious JavaScript by providing a crafted value in the album url parameter. This input is stored and s...