CVE-2026-93956

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-93956

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93956.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-93956

Published

2026-09-19T23:00:14Z

Modified

2026-09-23T03:30:25Z

Severity

2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting

Details

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 1.1.3 can resolve this issue. This patch is called 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93956.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "1.1.0"
                },
                {
                    "last_affected":  "1.1.0"
                },
                {
                    "introduced":  "1.1.1"
                },
                {
                    "last_affected":  "1.1.1"
                },
                {
                    "introduced":  "1.1.2"
                },
                {
                    "last_affected":  "1.1.2"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/olivier-ls/php-fts

Affected ranges

Type

GIT

Repo

https://github.com/olivier-ls/php-fts

Events

Introduced

Fixed

0b2fae333d6b022da7ed4c43e2d41aa03f91dff3

Database specific

Show details

{
    "source":  "REFERENCES"
}

Affected versions

v1.*

v1.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93956.json"