rootpwn

medium · CVSS v3 5.4

CVE-2026-92991

The Biggop Library contains a Cross-Site Scripting vulnerability in the 'display_id' parameter sourced from the Sigmative API. This issue ar

Overview

The Biggop Library contains a Cross-Site Scripting vulnerability in the 'display_id' parameter sourced from the Sigmative API. This issue arises from insufficient output escaping, allowing injected scripts to execute within users' browsers.

Description

The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Impact

An attacker who compromises the Sigmative API server can inject arbitrary web scripts, leading to potential session hijacking, credential theft, or unauthorized actions on behalf of the user viewing the affected page. This impacts the integrity and confidentiality of user interactions within the application.

Remediation

Apply the latest security updates or patches provided by the vendor for the Biggop Library. Implement proper contextual output encoding and input sanitization for all data received from external APIs, specifically focusing on the 'display_id' parameter.

Risk context

The vulnerability is rated as medium severity with a CVSS v3 score of 5.4, requiring prior compromise of an external API server to exploit, which moderates the immediate risk.

Affected products

  • Biggop Library

Scores

Severity
medium
CVSS v2
4
CVSS v3
5.4
CVSS v4
—
EPSS
—

CWE-79 XSS API Security Input Validation Web Security

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-77164

A blind Server-Side Request Forgery vulnerability exists in the Nextcloud Circles app remote-instance signature verification process. Unauthenticated endpoints allow attackers to force the server to issue GET requests to arbitrary internal addresses before trust is established. While response bodies are not returned, this flaw enables internal network reconnaissance and service discovery.

View analysis

medium

CVE-2026-77170

An access control vulnerability exists in the Deck config API that permits authenticated users to modify board-scoped configuration keys for arbitrary board IDs. The issue stems from a lack of validation regarding whether the user owns or holds permissions to manage the targeted board. This matters because it enables unauthorized configuration tampering across organizational boundaries within the application.

View analysis

medium

CVE-2026-82980

An improper authorization vulnerability exists in the WebDAV plugin where absolute request URIs are resolved without validating user ownership. Any authenticated user can lock or unlock files belonging to other users, leading to denial of service or unauthorized modification control. This issue matters because it impacts data integrity and availability in multi-tenant or shared file environments.

View analysis