CVE-2026-111837: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Wasiliy Strecker Contest Gallery

This vulnerability involves improper neutralization of input during web page generation in the Contest Gallery product by Wasiliy Strecker, leading to stored cross-site scripting (XSS). The flaw allows attackers with limited privileges and requiring user interaction to inject malicious scripts that can affect confidentiality, integrity, and availability of the affected system. The vulnerability affects all versions from initial releases up to but not including 34.0.2.

Successful exploitation can lead to execution of malicious scripts in the context of the affected web application, potentially resulting in partial loss of confidentiality, integrity, and availability. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, cautious handling of user input and applying web application firewall rules may help mitigate risk.