CVE-2026-61986: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Wasiliy Strecker Contest Gallery

This vulnerability (CVE-2026-61986) involves improper neutralization of input during web page generation (CWE-79) in Contest Gallery software versions <= 30.0.5. It enables unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks, potentially leading to execution of arbitrary scripts in the context of the victim's browser. The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can allow attackers to execute arbitrary scripts in users' browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability at a low level. The vulnerability is exploitable without authentication, increasing its risk.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible.