CVE-2026-4322 PUBLISHED

XSS in Raera's Destekz

Assigner: TR-CERT
Reserved: 17.03.2026 Published: 03.07.2026 Updated: 03.07.2026

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency Destekz allows Reflected XSS.

This issue affects Destekz: through 02062026. NOTE: The vendor was contacted and it was learned that the product is not supported.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS Score: 6.1

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	Low
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Raera - Ankara Web Design and Digital Advertising Agency
Product	Destekz
Versions	Default: unknown affected from 0 to 02062026 (incl.)

Credits

Hasan YILDIZ finder

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0488

Problem Types

CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') CWE

Impacts

CAPEC-591 Reflected XSS