CVE-2026-112835: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in e4jvikwp VikRentCar

The vulnerability CVE-2026-112835 in VikRentCar arises from improper input neutralization during web page generation, leading to reflected cross-site scripting (XSS). This allows an attacker to inject malicious scripts that execute in the victim's browser when they visit a crafted URL or page. The affected versions are all releases prior to 1.4.9. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges and requires user interaction, with a scope change and partial impacts on confidentiality, integrity, and availability. No patch or remediation details are provided in the source data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of the affected system or user data. The high CVSS score reflects these risks. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules or input validation as temporary mitigations.