QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-24127

Back to search

CVE-2026-24127

Published: Jan 23, 2026

Modified: Jan 26, 2026

PUBLISHED

CVSS v3.1

5.4

MEDIUM

Description

Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template `login.twig` of versions 2.19.1 and below. The `username` value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2.

VendorProductVersions

typemill

typemill

affected
< v2.19.2

Weaknesses (CWE)

CWE-79
CWE-116

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now