CVE-2026-61501

Popis

Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator-s browser when the logs are viewed, allowing the attacker to create accounts or execute code on the server with the administrator-s privileges.