Description
A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /edit_profile of the component Profile. The manipulation of the argument first_name/last_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-26
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Cross‑site scripting via user profile fields, potentially allowing attacker‑controlled script execution in victims’ browsers.
Action: Mitigate
AI Analysis

Impact

A vulnerability in the Garage 24 Garage Management Software allows manipulation of the first_name and last_name parameters on the /edit_profile page to inject arbitrary script. This cross‑site scripting flaw can cause embedded code to run in the context of a victim’s browser, enabling session hijacking, cookie theft, or delivery of malicious payloads. The description explicitly states that the attack may be initiated remotely and it has been disclosed publicly.

Affected Systems

The affected product is Bdtask Garage 24 Garage Management Software version 1.0. No other affected versions or sub‑products are documented in the current data.

Risk and Exploitability

The vulnerability scores a CVSS of 5.1, indicating moderate severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. Attackers can exploit this remotely by submitting crafted inputs through the web interface; because no official patch is available, exploitation is possible as soon as an attacker can reach the vulnerable endpoint.

Generated by OpenCVE AI on October 26, 2026 at 18:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any vendor‑supplied patch or newer release of Garage 24 as soon as it becomes available.
  • If a patch cannot be obtained, implement strict input validation and output encoding for the first_name and last_name fields to prevent script injection.
  • Consider disabling or restricting access to the /edit_profile endpoint and apply a web‑application firewall rule to block suspicious payloads until a patch is applied.

Generated by OpenCVE AI on October 26, 2026 at 18:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /edit_profile of the component Profile. The manipulation of the argument first_name/last_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting
First Time appeared Bdtask
Bdtask garage 24 Garage Management Software
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:bdtask:garage_24_garage_management_software:*:*:*:*:*:*:*:*
Vendors & Products Bdtask
Bdtask garage 24 Garage Management Software
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Bdtask Garage 24 Garage Management Software
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-26T19:35:21.597Z

Reserved: 2026-10-26T10:01:43.128Z

Link: CVE-2026-116385

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-26T18:17:43.773

Modified: 2026-10-26T18:41:21.450

Link: CVE-2026-116385

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T19:09:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')