CVE-2026-13536 Details
Description
A vulnerability has been found in GotoHTTP up to 10.2. This issue affects some unknown processing of the file /reg.12x. The manipulation of the argument sn leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor explains: "We immediately removed unnecessary parameter echo from source code. However the URL in the issue description will never be used in browser nor exposed to user, so it will not bring secure problem in fact. So we don't upgrade server right now, it will be included in next version together with other features."
A reflected cross-site scripting (XSS) vulnerability exists in GotoHTTP versions through 10.2. The issue arises in the /reg.12x endpoint, where the sn parameter is not properly sanitized before being echoed back to the client in the error message response. This flaw allows an unauthenticated attacker to inject arbitrary JavaScript, which could be executed in the context of the victim's browser. Potential consequences include session hijacking, credential theft, unauthorized actions on behalf of the victim, or information disclosure.
The vendor has stated that the issue will be addressed in a future version, but no immediate update is available.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 29, 2026CISA-ADP
Assessed Jun 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/submit/842066 | CISA-ADP | Issue TrackingPermission Required |
| https://github.com/Qq1111111111/CVE/issues/1 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/cve/CVE-2026-13536 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/842066 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/374544 | [email protected] | Technical DescriptionPermission Required |
| https://vuldb.com/vuln/374544/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GotoHTTP | <= 10.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | New CVE Received | [email protected] |