Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Loglama.net TurkHotspot allows Reflected XSS.

This issue affects TurkHotspot: through 2026-10-02. NOTE: The vendor was contacted and it was learned that the product is not supported.
Published: 2026-10-02
Score: 5.2 Medium
EPSS: n/a
KEV: No
Impact: Reflected XSS
Action: Mitigate
AI Analysis

Impact

Improper neutralization of user input during web page generation allows an attacker to inject malicious scripts that are reflected immediately back to the user. This cross‑site scripting flaw can be used to hijack user sessions, steal credentials, or deliver phishing payloads, all without persisting data on the server side. The weakness corresponds to CWE‑79, which highlights lack of output encoding or input filtering.

Affected Systems

The vulnerability is present in Loglama.net's TurkHotspot application through 2026‑10‑02. The vendor indicated that the product is no longer supported and does not offer a patch or update.

Risk and Exploitability

The CVSS score of 5.2 indicates moderate severity; no EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves an attacker crafting a malicious URL or form value that the application echoes back without proper sanitization. Since no official fix exists, the risk remains until mitigative controls are applied or the application is replaced.

Generated by OpenCVE AI on October 2, 2026 at 15:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Replace or remove any functionality that echoes untrusted user input in rendered pages.
  • Implement strict output encoding for all dynamic content or use a dedicated sanitization library to escape special characters.
  • Configure a web application firewall or intrusion detection system to block requests containing typical XSS payload patterns.
  • Consider migrating to a supported web application platform that enforces secure coding practices.

Generated by OpenCVE AI on October 2, 2026 at 15:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Description Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Loglama.net TurkHotspot allows Reflected XSS. This issue affects TurkHotspot: through 2026-10-02. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Loglama.net TurkHotspot allows Reflected XSS. This issue affects TurkHotspot: through 2026-10-02. NOTE: The vendor was contacted and it was learned that the product is not supported.

Fri, 02 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Loglama.net TurkHotspot allows Reflected XSS. This issue affects TurkHotspot: through 2026-10-02. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Title Reflected XSS in Loglama.NET's TurkHotspot
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.2, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published:

Updated: 2026-10-02T16:49:32.625Z

Reserved: 2026-04-08T08:43:59.844Z

Link: CVE-2026-5782

cve-icon Vulnrichment

Updated: 2026-10-02T16:49:27.794Z

cve-icon NVD

Status : Deferred

Published: 2026-10-02T15:17:10.180

Modified: 2026-10-02T18:30:40.097

Link: CVE-2026-5782

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T15:30:12Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')