CVE-2026-94665: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Mamunur Rashid Classified Listing

CVE-2026-94665 describes a stored cross-site scripting vulnerability in Mamunur Rashid Classified Listing software versions prior to 6.1.3. The flaw is due to improper neutralization of input during web page generation, which allows attackers to inject malicious scripts that are stored and later executed in the context of other users' browsers. The vulnerability has a CVSS 3.1 base score of 6.5, with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability partially.

Successful exploitation of this vulnerability can lead to partial loss of confidentiality, integrity, and availability of the affected system. Attackers may execute malicious scripts in users' browsers, potentially leading to session hijacking, data theft, or other malicious actions within the context of the vulnerable application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vendor communications for updates. In the meantime, applying input validation and output encoding best practices may help mitigate risk.