What is CVE-2026-71249?
A vulnerability in 299Ko's public contact form allows raw POST field values (name, firstname, email, message) to be placed into the page template without sanitization. The template engine's `_show_var()` echoes these values without HTML encoding, enabling stored or reflected XSS attacks, so immediate output sanitization is required.
Azərbaycanca: 299Ko platformasının ümumi əlaqə forması zəifliyi aşkar edilib. `ContactController.php` faylında POST sahələrindən alınan məlumatlar (ad, e-poçt, mesaj) heç bir təmizləmədən şablona ötürülür. Bu, XSS hücumlarına səbəb ola bilər — təcili olaraq `htmlspecialchars()` kimi çıxış kodlaşdırması tətbiq edilməlidir.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
In which component of the 299Ko platform was CVE-2026-71249 discovered?
The vulnerability was discovered in the `ContactController.php` file of the 299Ko platform's public contact form.
What immediate measure should be taken to mitigate this XSS vulnerability?
Immediate output sanitization using functions like `htmlspecialchars()` should be applied.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.