CVE-2026-108834
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79, CWE-94
Impact
Remote attackers can execute arbitrary JavaScript in a victim's browser if they trick them into clicking a crafted link. An unauthenticated attacker needs network access and user interaction.
Root cause
Improper sanitization of the 'p' query parameter in ww_page.php leads to reflected cross-site scripting.
Affected systems
Cairo-dock Glx-Dock up to 3.4.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No fixed version is available as the vendor did not respond. Restrict web access to ww_page.php or remove the exposed script from public web servers.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file ww_page.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.