{"id":"CVE-2026-1444","state":"PUBLISHED","title":"iJason-Liu Books_Manager add_book_check.php cross site scripting","description":"A vulnerability has been found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This affects an unknown part of the file controllers/books_center/add_book_check.php. Such manipulation of the argument mark leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.","publishedAt":"2026-01-26T21:32:05.930Z","updatedAt":"2026-02-23T08:58:35.112Z","severity":{"score":4.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["iJason-Liu Books_Manager"],"affected":[{"vendor":"iJason-Liu","product":"Books_Manager","versions":[{"version":"298ba736387ca37810466349af13a0fdf828e99c","status":"affected"}]}],"references":["https://vuldb.com/?id.342873","https://vuldb.com/?ctiid.342873","https://vuldb.com/?submit.736968","https://blog.y1fan.work/2026/01/13/%E5%AD%98%E5%82%A8%E5%9E%8Bxss/"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/1xxx/CVE-2026-1444.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-1444","state":"PUBLISHED","datePublished":"2026-01-26T21:32:05.930Z","dateUpdated":"2026-02-23T08:58:35.112Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-01-26T14:53:34.103Z"},"containers":{"cna":{"title":"iJason-Liu Books_Manager add_book_check.php cross site scripting","descriptions":[{"lang":"en","value":"A vulnerability has been found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This affects an unknown part of the file controllers/books_center/add_book_check.php. Such manipulation of the argument mark leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable."}],"affected":[{"vendor":"iJason-Liu","product":"Books_Manager","versions":[{"version":"298ba736387ca37810466349af13a0fdf828e99c","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.342873","name":"VDB-342873 | iJason-Liu Books_Manager add_book_check.php cross site scripting","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.342873","name":"VDB-342873 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.736968","name":"Submit #736968 | https://github.com/iJason-Liu/Books_Manager Books_Manager 1.0 Stored XSS","tags":["third-party-advisory"]},{"url":"https://blog.y1fan.work/2026/01/13/%E5%AD%98%E5%82%A8%E5%9E%8Bxss/","tags":["broken-link","exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.8,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":2.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":2.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":3.3,"vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-02-23T08:58:35.112Z"},"timeline":[{"time":"2026-01-26T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-01-26T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-01-28T13:04:29.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"y1fan (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-27T21:41:24.830204Z","id":"CVE-2026-1444","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-27T21:41:33.130Z"}}]}}}