CVE-2026-11772
Description
DRIMO CMS is vulnerable to Reflected XSS via q parameter in searching functionality. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser.
Product is in End Of Life phase and will not receive any updates. However, deleting info.php file mitigates the vulnerability,
Summary dbcve.org
DRIMO CMS contains a reflected XSS vulnerability in its search functionality where the 'q' parameter is not properly sanitized. An attacker can craft a malicious URL containing JavaScript code that will execute in the victim's browser when they visit the crafted link.
Mitigation
Delete the info.php file from the server, which eliminates the attack vector. This is the recommended workaround since the product is end-of-life and will not receive official security patches.