Webasyst CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Webasyst CVE published 2026-10-26

CVE-2026-116212

CVE-2026-116212 is a stored cross-site scripting vulnerability in the Photos app of Webasyst Framework through version 4.4.0. Authenticated backend users with album edit rights can inject JavaScript via the album URL parameter, which can execute in administrators' backend sessions. This vulnerability allows attackers to potentially take unauthorized actions within the backend, emphasizing the need for def [truncated]