CVE-2026-105887: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Robosoft Robo Gallery

Robosoft Robo Gallery versions prior to 5.2.6 suffer from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows attackers with limited privileges to inject malicious scripts that persist and execute in the context of users viewing the affected pages. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, and user interaction, with impacts on confidentiality, integrity, and availability. No vendor advisory or patch link is provided, but the affected versions are clearly identified as all versions before 5.2.6.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in data disclosure, modification, or disruption of service. The vulnerability requires attacker privileges and user interaction, limiting the ease of exploitation. The impact affects confidentiality, integrity, and availability at a low level.

Upgrade Robosoft Robo Gallery to version 5.2.6 or later, where this vulnerability is fixed. No vendor advisory or patch link is provided, so verify the update availability with the vendor. Until patched, restrict user privileges and sanitize inputs where possible to reduce risk.