Vulnerabilities ›

CVE-2026-1434

Medium

Omega-PSIR is vulnerable to Reflected XSS via the lang parameter. An attacker can craft a malicious URL that, when opened, causes arbitrary JavaScript to execute in the victim’s browser. This issue w

CWE-79 — Weakness Type

                    Published: Feb 27, 2026                      ·  Modified: Mar 5, 2026                      ·  Source: NVD                

CVSS v3

6.1

🔗 NVD Official

📄 Description (English)

🤖 AI Executive Summary

Omega-PSIR contains a Reflected XSS vulnerability in the lang parameter (CVE-2026-1434, CVSS 6.1) allowing arbitrary JavaScript execution through malicious URLs. While no public exploit exists, the vulnerability poses a medium risk to organizations using this application. Patching to version 4.6.7 or later is required to remediate this issue.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: May 23, 2026 22:19

🇸🇦 Saudi Arabia Impact Assessment

This vulnerability primarily affects Saudi government agencies, financial institutions, and healthcare organizations that deploy Omega-PSIR for administrative or reporting functions. Government entities under NCA oversight and SAMA-regulated financial institutions face elevated risk due to potential data exfiltration and session hijacking. The XSS vector could enable credential theft targeting Saudi nationals accessing these systems, particularly impacting e-government portals and banking platforms.

🏢 Affected Saudi Sectors

Government Banking and Financial Services Healthcare Telecommunications Energy Education

🎯 MITRE ATT&CK Techniques

T1598 - Phishing: Spearphishing Link T1566 - Phishing T1059 - Command and Scripting Interpreter T1185 - Browser Session Hijacking T1056 - Input Capture

⚖️ Saudi Risk Score (AI)

6.2

/ 10.0

🔧 Remediation Steps (English)

Immediate Actions:

1. Identify all instances of Omega-PSIR in your environment and document versions

2. Restrict access to Omega-PSIR applications to trusted networks only

3. Implement URL filtering to block suspicious lang parameter values

4. Alert users not to click links from untrusted sources pointing to Omega-PSIR



Patching Guidance:

1. Upgrade to Omega-PSIR version 4.6.7 or later immediately

2. Test patches in non-production environments first

3. Schedule patching during maintenance windows with stakeholder approval



Compensating Controls (if patching delayed):

1. Deploy Web Application Firewall (WAF) rules to sanitize lang parameter input

2. Implement Content Security Policy (CSP) headers to restrict script execution

3. Enable HTTP-only and Secure flags on session cookies

4. Implement input validation on the lang parameter (whitelist allowed language codes)



Detection Rules:

1. Monitor for lang parameter values containing script tags or JavaScript keywords

2. Alert on unusual character encoding in lang parameter (e.g., %3C, %3E)

3. Log and review all requests with lang parameter containing special characters

4. Implement SIEM rules to detect XSS payloads in HTTP requests

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. تحديد جميع نسخ Omega-PSIR في بيئتك وتوثيق الإصدارات

2. تقييد الوصول إلى تطبيقات Omega-PSIR على الشبكات الموثوقة فقط

3. تطبيق تصفية عناوين URL لحظر قيم معامل lang المريبة

4. تنبيه المستخدمين بعدم النقر على الروابط من مصادر غير موثوقة تشير إلى Omega-PSIR

إرشادات التصحيح:

1. الترقية إلى Omega-PSIR الإصدار 4.6.7 أو أحدث فوراً

2. اختبار التصحيحات في بيئات غير الإنتاج أولاً

3. جدولة التصحيح خلال نوافذ الصيانة مع موافقة أصحاب المصلحة

الضوابط البديلة (إذا تأخر التصحيح):

1. نشر قواعد جدار حماية تطبيقات الويب (WAF) لتنظيف مدخلات معامل lang

2. تطبيق رؤوس سياسة أمان المحتوى (CSP) لتقييد تنفيذ البرامج النصية

3. تفعيل أعلام HTTP-only و Secure على ملفات تعريف الجلسة

4. تطبيق التحقق من صحة المدخلات على معامل lang (قائمة بيضاء برموز اللغات المسموحة)

قواعد الكشف:

1. مراقبة قيم معامل lang التي تحتوي على علامات البرامج النصية أو كلمات JavaScript الرئيسية

2. التنبيه على ترميز الأحرف غير المعتاد في معامل lang (مثل %3C، %3E)

3. تسجيل ومراجعة جميع الطلبات مع معامل lang يحتوي على أحرف خاصة

4. تطبيق قواعد SIEM للكشف عن حمولات XSS في طلبات HTTP

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2024 A.14.2.1 - Information security requirements in supplier relationships ECC 2024 A.5.1.1 - Policies for information security ECC 2024 A.14.2.5 - Supplier security incident management

🔵 SAMA CSF

SAMA CSF ID.GV-1 - Organizational governance and risk management SAMA CSF PR.AC-1 - Access control and identity management SAMA CSF DE.CM-1 - Detection and monitoring of security events

🟡 ISO 27001:2022

ISO 27001:2022 A.5.1 - Policies for information security ISO 27001:2022 A.8.1 - User endpoint devices ISO 27001:2022 A.8.3 - Access control ISO 27001:2022 A.14.2 - Supplier relationships

🟣 PCI DSS v4.0.1

PCI DSS 6.5.7 - Cross-site scripting (XSS) prevention PCI DSS 6.2 - Security patches and updates

🔗 References & Sources 2

🔗

https://cert.pl/posts/2026/02/CVE-2026-1434

cvd@cert.pl

Third Party Advisory

🔗

https://www.omegapsir.io/

cvd@cert.pl

Product

📦 Affected Products / CPE 1 entries

pw:omega-psir

📊 CVSS Score

6.1

/ 10.0 — Medium

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionR — Required

ScopeC — Changed

ConfidentialityL — Low / Local

IntegrityL — Low / Local

AvailabilityN — None / Network

📋 Quick Facts

Severity Medium

CVSS Score6.1

CWECWE-79

EPSS0.05%

Exploit No

Patch ✗ No

Published 2026-02-27

Source Feed nvd

🇸🇦 Saudi Risk Score

6.2

/ 10.0 — Saudi Risk

Priority: HIGH

🏷️ Tags

CWE-79

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2026-1434

Introduce Yourself

Sign In Required