CVE-2026-112838: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in e4jvikwp VikRentCar

CVE-2026-112838 describes a stored cross-site scripting (XSS) vulnerability in the VikRentCar product by e4jvikwp. The vulnerability arises from improper neutralization of input during web page generation, enabling attackers to inject and store malicious scripts that execute when viewed by other users. This affects all versions from the initial release up to and including version 1.4.8.

Successful exploitation of this vulnerability can lead to cross-site scripting attacks, which may result in the attacker executing arbitrary scripts in the context of the victim's browser. This can lead to information disclosure, session hijacking, or other client-side impacts. The CVSS score of 7.1 (high) reflects the network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should apply standard XSS mitigations such as input validation and output encoding where possible.