CVE-2026-58205

GRR is a resource management and reservation application. Prior to version 4.5.0, maj.php reflects the forcemaj parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in...