CVE-2026-3041

A security vulnerability has been detected in xingfuggz BaykeShop up to 1.3.20. Impacted is an unknown function of the file src/baykeshop/contrib/article/templates/baykeshop/sidebar/custom.html of the component Article Sidebar Module. Such manipulation of the argument sidebar.content leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-79
• CWE-94

• https://github.com/xingfuggz/baykeShop/
• https://github.com/xingfuggz/baykeShop/issues/1
• https://github.com/xingfuggz/baykeShop/issues/1#issue-3931488211
• https://vuldb.com/?ctiid.347397
• https://vuldb.com/?id.347397
• https://vuldb.com/?submit.757165

Published

Feb 23, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3040A vulnerability was identified in DrayTek Vigor 300B up to 1…7.2
• CVE-2026-30402An issue in wgcloud v.2.3.7 and before allows a remote attac…9.8
• CVE-2026-30403There is an arbitrary file read vulnerability in the test co…7.5
• CVE-2026-30404The backend database management connection test feature in w…7.5
• CVE-2026-30405An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to…7.5
• CVE-2026-30407Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
• CVE-2026-3042A vulnerability was detected in itsourcecode Event Managemen…9.8
• CVE-2026-3043A flaw has been found in itsourcecode Event Management Syste…6.1
• CVE-2026-3044A vulnerability has been found in Tenda AC8 16.03.34.06. Thi…8.8
• CVE-2026-3045The Appointment Booking Calendar — Simply Schedule Appointme…7.5
• CVE-2026-30452Textpattern CMS 4.9.0 contains a Broken Access Control vulne…6.5
• CVE-2026-30457An issue in the /parser/dwoo component of Daylight Studio Fu…9.8