TI-2026-82319 Aliases CVE-2026-7190 GHSA-874x-f28p-552g

Reflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration

LOW 23CWE-79Published 2026-10-29 · Updated 2026-10-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A cross-site scripting (XSS) vulnerability in ICTBroadcast, which affects the demo environment, is in the login.php endpoint, where the editForm[extension_username] parameter is reflected in the response without proper filtering. Successful exploitation lets an attacker run arbitrary JavaScript in the victim's browser after the victim opens a malicious URL. The weakness is CWE-79, and the CVSS 4.0 base score is 5.1 (MEDIUM).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in the ‘login.php’ endpoint, where the ‘editForm[extension_username]’ parameter is reflected in the response without proper filtering. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser once the victim accesses the malicious URL.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00335 27th percentileScored 2026-11-07

Fix Fixed ICT Innovations’ PHP-CGI/PHP-FPM configuration (ICT Innovations): March 2026

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ICT Innovations	ICT Innovations’ PHP-CGI/PHP-FPM configuration	before March 2026	March 2026	Patch available	CNA

ICT Innovations’ PHP-CGI/PHP-FPM configuration VendorICT Innovations Affected before March 2026 Fixed in March 2026 Patch available CNA

Remediation

Update to March 2026 or later, the fixed release. Versions before March 2026 are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA ICT Innovations’ PHP-CGI/PHP-FPM configuration (ICT Innovations) Fixed in March 2026

Timeline

2026-10-29 Threatist record created from CVE-2026-7190
2026-10-29 Alias added: GHSA-874x-f28p-552g
2026-10-29 CISA SSVC decision points changed

References

Other 1

https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-ict-innovations-php-cgiphp-fpm

TI-2025-02278 ICTBroadcast <= 7.4 Unauthenticated Session Cookie RCE CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences