Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Menulux Software Inc. (CVE-2026-18957)

CVE-2026-18957 is a stored cross-site scripting vulnerability in Menulux Portal caused by improper input neutralization during web page generation. This flaw allows an attacker with low privileges and requiring user interaction to execute scripts in a context that can compromise confidentiality and integrity but does not affect availability. The vulnerability affects Menulux Portal versions prior to build 20260903211448. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.

Successful exploitation can lead to limited confidentiality and integrity impacts, such as theft of user session data or modification of displayed content. There is no impact on availability. The attacker requires some level of privileges and user interaction to exploit this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor communications for official patches or updates.