CVE-2026-111877: Cross Site Scripting in dext34-morgan Books4Cash

This vulnerability in dext34-morgan Books4Cash up to commit a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571 allows remote attackers to perform cross-site scripting via manipulation of the Search parameter in search.php. The flaw enables injection of malicious scripts due to insufficient input sanitization or output encoding. The project has been inactive for years, and no official patch or remediation has been published. The vulnerability was publicly disclosed and carries a CVSS 4.0 score of 5.3, indicating medium severity.

Successful exploitation can lead to execution of arbitrary scripts in the context of the vulnerable web application, potentially allowing attackers to perform actions such as session hijacking or defacement. However, the impact is limited to cross-site scripting without elevation of privileges or direct system compromise. No known active exploitation in the wild has been reported.

No official fix or patch is available due to the project's inactivity. Users should consider discontinuing use of the affected software or implementing web application firewall (WAF) rules to block malicious input targeting the Search parameter. Additionally, isolating the application and restricting access may reduce exposure. Monitor vendor or community channels for any future updates or forks that address this issue.