VulnSocial

CVE-2026-93956Disclosure

LOWCVSS 2.0 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 1.1.3 can resolve this issue. This patch is called 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-20); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-20: 1Mentions · 2026-10-29: 1Patch / Workaround · 2026-10-29: 1Technical Details · 2026-09-20: 1Technical Details · 2026-10-29: 109-2010-29
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-201
Disclosure1
2026-10-291
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity@HugoValters
    Patch

    CVE-2026-93956: reflected XSS in PHP-FTS up to 1.1.2 via SearchEngine::buildHighlights, CVSS 3.5. Public exploit exists, so patch to 1.1.3 now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-93956/ #PhpFts #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The text discloses CVE-2026-93956 as a reflected XSS vulnerability in PHP-FTS up to 1.1.2 with CVSS 3.5, notes a public exploit exists, and explicitly recommends patching to version 1.1.3 as remediation.

    0000050
    1.1K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-93956 A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the … https://www.cve.org/CVERecord?id=CVE-2026-93956

    Post summary

    The text announces CVE-2026-93956 affecting olivier-ls PHP-FTS and provides technical context (affected function/file) but includes no PoC, exploit, patch, or active-exploitation information—only a link to the CVE record.

    000001.6K
    58.1K followersView on X

Explore more

Back to dashboard