MEDIUM 4.7 NVD
CVE-2026-79315
A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding e
A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the entities before the client-side framework evaluates the content as a JavaScript expression. A logged-in panel user who visits a crafted URL allows arbitrary script execution in the same-origin context of the management page, enabling data theft and unauthorized actions through the victim's session.
References
- https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79315.md
- https://github.com/vaxilu/x-ui
This medium severity vulnerability with a CVSS score of 4.7 was published on 2026-09-22 via NVD.
vulnfeed aggregates 14151 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.