Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote… (CVE-2026-75170)

The HubCore platform version 14.1.1 contains a reflected cross-site scripting (XSS) vulnerability in its /loginController/doLogin endpoint. An attacker can exploit this by sending a specially crafted POST request with malicious JavaScript code in the language parameter. The application does not properly sanitize this input before including it in the response, enabling script injection that could lead to client-side code execution in the context of the victim's browser.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of the affected application for users interacting with the vulnerable endpoint. This could lead to session hijacking, defacement, or other client-side attacks. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or output encoding on the language parameter to mitigate the risk of XSS. Monitor vendor channels for updates regarding patches or official mitigations.