CVE-2026-105323 PUBLISHED

Reflected XSS in Kulga Software's Kulga News Software

Assigner: TR-CERT
Reserved: 05.10.2026 Published: 27.10.2026 Updated: 27.10.2026

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company Kulga News Software allows Reflected XSS.

This issue affects Kulga News Software: from v26.7.4 before v26.10.0.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS Score: 6.1

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	Low
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Kulga Software and Telecommunications Limited Company
Product	Kulga News Software
Versions	Default: unaffected affected from v26.7.4 to v26.10.0 (excl.)

Credits

Emirhan Efeoglu finder

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1405

Problem Types

CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') CWE

Impacts

CAPEC-591 Reflected XSS