CVE-2026-39766: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in reputeinfosystems ARForms

CVE-2026-39766 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in reputeinfosystems ARForms affecting versions up to 7.1.2. The vulnerability arises from improper neutralization of input during web page generation, classified under CWE-79. The CVSS v3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes low confidentiality, integrity, and availability impacts. No vendor advisory or patch information is available in the provided data.

The vulnerability allows unauthenticated attackers to inject malicious scripts into web pages generated by ARForms, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 7.1 reflects a high severity with the possibility of user interaction required for exploitation. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider applying web application firewall (WAF) rules to detect and block XSS attempts if applicable.