Studio Fabryka DobryCMS Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Studio Fabryka DobryCMS versions 2.* and prior. The issue arises from inadequate input validation in the 'szukaj' parameter, which allows the execution of arbitrary JavaScript in the victim's browser when a specially crafted URL is accessed. A hotfix was released on April 29, 2025, addressing the vulnerability without changing the software version.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious JavaScript that is executed in the context of the user's browser.

Remediation

Users can apply the hotfix released on April 29, 2025, which addresses the vulnerability without incrementing the software version.