A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. (CVE-2026-108834)

CVE-2026-108834 describes a cross-site scripting vulnerability in Cairo-dock Glx-Dock versions up to 3.4.0. The flaw arises from improper handling of the 'p' parameter in the ww_page.php file within the Query Parameter Handler component, allowing remote attackers to inject malicious scripts. The vulnerability has a CVSS 3.1 base score of 4.3 (low severity), with attack vector network, low attack complexity, no privileges required, user interaction required, and impacts integrity but not confidentiality or availability. Public exploit code exists, and the vendor has not issued a fix or responded to reports.

Successful exploitation allows an attacker to perform cross-site scripting attacks by injecting malicious scripts via the 'p' parameter. This can lead to limited integrity impact such as executing unauthorized scripts in the context of the affected application. There is no direct impact on confidentiality or availability. The vulnerability can be exploited remotely but requires user interaction.

No official fix or patch is currently available, and the vendor has not responded to disclosure attempts. Users should apply general XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for any future advisories or patches. Until a fix is released, consider restricting access to the vulnerable component or employing web application firewalls to detect and block XSS payloads targeting the 'p' parameter.