CVE-2026-75170: n/a

This vulnerability exists in the HubCore platform version 14.1.1 at the /loginController/doLogin endpoint. An attacker can exploit improper input validation on the language POST parameter to inject arbitrary JavaScript code into the application's response, leading to a reflected cross-site scripting (XSS) condition. This flaw requires no authentication and can be triggered remotely. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, with low confidentiality and integrity impact and no availability impact.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, information disclosure, or other client-side impacts. The vulnerability affects confidentiality and integrity but does not impact availability. No known exploits are reported in the wild.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation or filtering on the language parameter at the application or web server level to mitigate injection risks.