CVE-2026-93956

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 1.1.3 can resolve this issue. This patch is called 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

• CWE-79
• CWE-94

• https://github.com/olivier-ls/php-fts/
• https://github.com/olivier-ls/php-fts/commit/0b2fae333d6b022da7ed4c43e2d41aa03f91dff3
• https://github.com/olivier-ls/php-fts/issues/1
• https://github.com/olivier-ls/php-fts/tags
• https://github.com/sumo166/CVE-apply/blob/main/olivier-ls/PHP-FTS/SearchEngine%20buildHighlights%20Stored%20XSS%20(CWE-79)_cve.md
• https://vuldb.com/cve/CVE-2026-93956
• https://vuldb.com/submit/943922
• https://vuldb.com/vuln/407915
• https://vuldb.com/vuln/407915/cti

Published

Sep 19, 2026

Last Modified

Sep 19, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93923SiYuan through 3.8.4 fails to escape heading style attribute…8.8
• CVE-2026-9393A vulnerability was found in H3C Magic B0 up to 100R002. Thi…8.8
• CVE-2026-9394A vulnerability was determined in Besen BS20 EV Charging Sta…3.1
• CVE-2026-9395A vulnerability was identified in Besen BS20 EV Charging Sta…3.5
• CVE-2026-93954A security vulnerability has been detected in grimmory-tools…4.3
• CVE-2026-93955A vulnerability was detected in grimmory-tools grimmory up t…4.3
• CVE-2026-9396A security flaw has been discovered in Besen BS20 EV Chargin…3.7
• CVE-2026-9397A weakness has been identified in Besen BS20 EV Charging Sta…8.2
• CVE-2026-9398A security vulnerability has been detected in Besen BS20 EV …3.1
• CVE-2026-93981hono before 4.13.7 fails to HTML-escape plain strings render…4.7
• CVE-2026-93982OpenPanel through commit bad75bdd writes Model Context Proto…3.3
• CVE-2026-93983OpenPanel through commit bad75bdd fails to escape property k…5