Vulnerabilities ›

CVE-2025-41026

Medium

Reflected Cross Site Scripting (XSS) vulnerabilities in GDTaller. These vulnerabilities allows an attacker execute JavaScript code in the victim's browser by sending a malicious URL in 'site' paramet

CWE-79 — Weakness Type

                    Published: Mar 26, 2026                      ·  Modified: Mar 29, 2026                      ·  Source: NVD                

CVSS v3

6.1

🔗 NVD Official

📄 Description (English)

Reflected Cross Site Scripting (XSS) vulnerabilities in GDTaller. These vulnerabilities allows an attacker execute JavaScript code in the victim's browser by sending a malicious URL in 'site' parameter in 'app_login.php'.

🤖 AI Executive Summary

CVE-2025-41026 is a reflected XSS vulnerability in GDTaller's app_login.php that allows attackers to execute arbitrary JavaScript code through a malicious 'site' parameter. This vulnerability enables session hijacking, credential theft, and malware distribution to affected users.

📄 Description (Arabic)

ثغرة XSS المنعكسة في GDTaller تسمح للمهاجمين بتنفيذ كود JavaScript عشوائي عبر معامل 'site' في صفحة تسجيل الدخول. يمكن للمهاجمين استغلال هذه الثغرة لسرقة بيانات اعتماد المستخدمين وخطف الجلسات وتوزيع البرامج الضارة.

🤖 ملخص تنفيذي (AI)

This reflected XSS flaw in GDTaller permits attackers to inject malicious scripts via the 'site' parameter in the login page. Attackers can steal user credentials, hijack sessions, and compromise user browsers through crafted URLs.

🤖 AI Intelligence Analysis Analyzed: May 23, 2026 02:01

🇸🇦 Saudi Arabia Impact Assessment

Saudi Relevance: high

🏢 Affected Saudi Sectors

banking government healthcare telecom

🎯 MITRE ATT&CK Techniques

T1598.003 T1566.002 T1566.003

⚖️ Saudi Risk Score (AI)

7.0

/ 10.0

🔧 Remediation Steps (English)

Update GDTaller to the latest patched version immediately. Implement input validation and output encoding for all user-supplied parameters, particularly the 'site' parameter in app_login.php. Deploy Web Application Firewall (WAF) rules to detect and block XSS payloads. Conduct security code review of all login-related functionality.

🔧 خطوات المعالجة (العربية)

قم بتحديث GDTaller إلى أحدث إصدار معدل فوراً. طبق التحقق من صحة المدخلات وترميز المخرجات لجميع معاملات المستخدم خاصة معامل 'site'. نشر قواعد جدار حماية تطبيقات الويب لكشف حقن XSS. أجر مراجعة أمان شاملة لكود وظائف تسجيل الدخول.

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

5.2.1 5.2.2

🔵 SAMA CSF

AC-3 SI-10

🟡 ISO 27001:2022

A.14.2.1 A.14.2.5

🔗 References & Sources 1

🔗

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gdtaller

cve-coordination@incibe.es

Third Party Advisory

📦 Affected Products / CPE 1 entries

gdtaller:gdtaller:-

📊 CVSS Score

6.1

/ 10.0 — Medium

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionR — Required

ScopeC — Changed

ConfidentialityL — Low / Local

IntegrityL — Low / Local

AvailabilityN — None / Network

📋 Quick Facts

Severity Medium

CVSS Score6.1

CWECWE-79

Exploit No

Patch ✗ No

Published 2026-03-26

Source Feed nvd

🇸🇦 Saudi Risk Score

7.0

/ 10.0 — Saudi Risk

Priority: HIGH

🏷️ Tags

CWE-79

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2025-41026

Introduce Yourself

Sign In Required