Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter. The application constructs $currentdir from user-controlled input and embeds it into an error message without output encoding, allowing an attacker to supply HTML/JavaScript that is reflected in the response. Successful exploitation can lead to execution of arbitrary script in a victim's browser in the context of the vulnerable application.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-25868 Reflected XSS Vulnerability in MiniGal Nano 0.3.5 via Unvalidated dir Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25868
Post summary
A reflected XSS vulnerability is disclosed for MiniGal Nano 0.3.5 through an unvalidated "dir" parameter, but no exploit, patch, or active exploitation is mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | rybber | minigal_nano | - | - | - |