Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based… (CVE-2026-109895)

This vulnerability (CVE-2026-109895) in Arraytics Booktics (up to version 1.0.29) is caused by improper neutralization of input during web page generation, resulting in a DOM-based Cross-site Scripting (XSS) flaw. The issue allows an attacker to inject and execute arbitrary scripts in the victim's browser when interacting with the affected web application. The CVSS 3.1 score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low levels.

Successful exploitation can lead to execution of malicious scripts in users' browsers, potentially allowing theft of sensitive information, session hijacking, or disruption of application availability. The impact includes partial loss of confidentiality, integrity, and availability as indicated by the CVSS vector.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider applying input validation or output encoding workarounds if feasible.