Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-85541 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.1 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CNA: [email protected]CVSS-B:5.4 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.twcert.org.tw/en/cp-139-11184-9ad14-2.html	[email protected]	AdvisoryBundleRemedy
https://www.twcert.org.tw/tw/cp-132-11183-06a5e-1.html	[email protected]	AdvisoryBundleRemedy

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	[email protected]

Affected Products

Product	Versions
Interinfo DreamMaker	All versions
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: Java Composer Server 2.3moderate effort Workaround:low effort Disable or restrict access to baServer3. If your system is updated to a version between April 2026 and June 2026, you can use the WLIST whitelist mechanism to restrict access to jform and baServer3. If there is no need to develop, maintain, or manage baServer3, you can remove, disable, or rename the servlet/baServer3.class file. This will not affect the normal operation of existing applications, but you will no longer be able to use this Servlet for related management or development functions.

Product

Versions

Interinfo DreamMaker

All versions

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: Java Composer Server 2.3moderate effort
Workaround:low effort
Disable or restrict access to baServer3. If your system is updated to a version between April 2026 and June 2026, you can use the WLIST whitelist mechanism to restrict access to jform and baServer3. If there is no need to develop, maintain, or manage baServer3, you can remove, disable, or rename the servlet/baServer3.class file. This will not affect the normal operation of existing applications, but you will no longer be able to use this Servlet for related management or development functions.

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 4, 2026	CVE Modified	CISA-ADP
Sep 4, 2026	New CVE Received	[email protected]