CVE-2026-19057: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Gastromenum Gastromenum Ticket and QR Menu System

The Gastromenum Ticket and QR Menu System suffers from a stored cross-site scripting (CWE-79) vulnerability due to improper input neutralization during web page generation. This flaw allows attackers with limited privileges and requiring user interaction to inject malicious scripts that can execute in the context of other users, potentially leading to partial confidentiality and integrity impacts. The vulnerability affects versions prior to 2026.08.31. No vendor advisory or patch information is currently available.

Successful exploitation can lead to partial confidentiality and integrity impacts by executing malicious scripts in users' browsers. There is no impact on availability. The attack requires network access, low attack complexity, privileges, and user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply general best practices for mitigating stored XSS, such as input validation and output encoding where possible, and limit user privileges. Monitor vendor communications for updates.