CVE-2026-97294: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in David Lingren Media LIbrary Assistant

The Media LIbrary Assistant software by David Lingren contains a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows an attacker with low privileges and requiring user interaction to inject malicious scripts that can execute in the context of other users. The vulnerability affects all versions from initial release through 3.41. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently referenced, and no known active exploitation is reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated medium severity based on the CVSS score of 6.5. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit privileges of users who can input data and apply web application firewall rules to detect and block XSS payloads where possible.