Beyaz CityPLus Reflective XSS (CVE-2026-5783) Poses High Risk

The National Vulnerability Database (NVD) has documented CVE-2026-5783, a high-severity reflected cross-site scripting (XSS) vulnerability affecting Beyaz Computer Software Design Industry and Trade Ltd. Co.’s CityPLus software. This flaw, rated 7.6 CVSSv3.1, stems from improper input neutralization during web page generation, allowing attackers to inject malicious scripts.

Specifically, the NVD notes that all versions of CityPLus prior to V24.29750.1.0 are vulnerable. A successful exploit could lead to data theft, session hijacking, or defacement, depending on the attacker’s objectives and the victim’s privileges. The attacker’s calculus here is low effort, high reward – leveraging user interaction to execute code within a trusted context.

Defenders should prioritize patching CityPLus instances immediately. This isn’t a complex RCE, but XSS can be a potent vector for further compromise, especially in web applications handling sensitive data. Ensure all web application firewalls (WAFs) have robust XSS protection rules in place, though patching remains the primary defense.