Description
A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file ww_page.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross Site Scripting
Action: Mitigate
AI Analysis

Impact

The vulnerability in Cairo-dock Glx‑Dock arises from improper handling of the query parameter "p" in ww_page.php. An attacker can supply a crafted value that is reflected and executed as JavaScript, leading to a cross‑site scripting flaw (CWE‑79) and unsafe code execution (CWE‑94). If the attacker succeeds, malicious code runs in the context of the application or the authenticated user, allowing cookie theft, page defacement, or phishing attacks.

Affected Systems

Cairo‑dock Glx‑Dock, versions up to and including 3.4.0, are affected by this flaw. The issue resides in the Query Parameter Handler component of the ww_page.php file in those releases.

Risk and Exploitability

The vulnerability’s CVSS v3 score of 5.3 places it in the medium‑severity range, and its EPSS score is currently unavailable, indicating exploitation likelihood is uncertain. The exploit is public and can be carried out remotely by submitting a crafted "p" argument. The flaw is not listed in the CISA KEV catalog, but the remote nature and payload injection make it a potential target for attackers with access to the Glx‑Dock web interface.

Generated by OpenCVE AI on October 12, 2026 at 13:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Filter and escape all characters in the "p" query parameter before it is rendered, preventing embedded scripts from executing.
  • Deploy a content‑security‑policy that blocks inline script execution and disallows untrusted external scripts.
  • Deploy a web‑application firewall that sanitizes or rejects malicious payloads targeting the "p" parameter.
  • Monitor vendor communications and apply any future official patch when it is released.

Generated by OpenCVE AI on October 12, 2026 at 13:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file ww_page.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Cairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting
First Time appeared Cairo-dock
Cairo-dock glx-dock
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:cairo-dock:glx-dock:*:*:*:*:*:*:*:*
Vendors & Products Cairo-dock
Cairo-dock glx-dock
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Cairo-dock Glx-dock
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T15:00:26.495Z

Reserved: 2026-10-11T11:39:44.418Z

Link: CVE-2026-108834

cve-icon Vulnrichment

Updated: 2026-10-13T15:00:08.524Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T13:17:27.090

Modified: 2026-10-13T16:17:12.670

Link: CVE-2026-108834

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T15:30:13Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')