CVE-2026-77818: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program

This vulnerability (CWE-79) in Yordam's Library Information and Document Automation Program allows an attacker to inject malicious scripts due to improper input neutralization during web page generation. This can result in content spoofing, where the attacker can manipulate the displayed content to deceive users. The affected version is 22.1, and the issue is fixed starting from version 22.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, with low confidentiality and integrity impact and no availability impact.

Successful exploitation can lead to content spoofing, potentially misleading users or causing them to execute unintended actions. The confidentiality and integrity impacts are low, and there is no impact on availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been provided, users should monitor vendor communications for updates. Until a patch is available, cautious handling of untrusted input and limiting user interaction with suspicious content may reduce risk.