CVE-2026-18957: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Menulux Software Inc. Menulux Portal

This vulnerability (CVE-2026-18957) in Menulux Portal is a stored cross-site scripting (CWE-79) flaw caused by improper input neutralization during web page generation. It allows attackers with low privileges and requiring user interaction to inject malicious scripts that can execute in the context of other users' browsers. The vulnerability affects Menulux Portal versions prior to 20260903211448. There is no vendor advisory or patch information provided at this time.

Successful exploitation could lead to limited confidentiality and integrity impacts by executing arbitrary scripts in the victim's browser context. There is no impact on availability. The attack requires user interaction and low privileges, limiting the overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider applying web application firewall rules or input sanitization as temporary mitigations.