CVE-2026-5953: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Ceviz Informatics Inc. Web Design

This vulnerability (CVE-2026-5953) is a reflected cross-site scripting (XSS) flaw in Ceviz Informatics Inc. Web Design software, caused by improper neutralization of input during web page generation. This allows attackers to inject malicious scripts that can be reflected back to users, potentially leading to limited confidentiality and integrity impacts. The CVSS 3.1 base score is 6.1, indicating medium severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The affected versions include all versions up to 25082026. No vendor advisory or patch information is currently available.

The vulnerability allows an attacker to perform reflected XSS attacks, which can lead to limited confidentiality and integrity impacts by executing malicious scripts in the context of the victim's browser. There is no impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts if possible.