Security readout for executives and security teams
Plain-English summary
CVE-2026-1444 is a stored cross-site scripting issue in iJason-Liu Books_Manager. An attacker with high privileges could place malicious content through the book-add workflow, affecting another user who later views it. Business urgency is moderate: impact is limited, but public disclosure increases risk for any exposed or internally used deployments.
Executive priority
Treat as a moderate-priority application security issue. Prioritize if Books_Manager is internet-accessible, used by administrators, or stores sensitive workflow data. If the application is not deployed, no action is needed beyond documenting non-exposure.
Technical view
The issue affects controllers/books_center/add_book_check.php in Books_Manager up to commit 298ba736387ca37810466349af13a0fdf828e99c. Manipulation of the mark argument can lead to stored XSS. CVSS v4.0 is 4.8 with network attack vector, low complexity, high privileges required, and user interaction present. The product lacks versioning, so affected and fixed release boundaries are unclear.
Likely exposure
Likely exposure is limited to organizations running iJason-Liu Books_Manager, especially deployments reachable by authenticated administrative or privileged users. Public-facing instances increase concern, but the CVSS indicates high privileges are required before exploitation.
Exploitation context
The source bundle says an exploit has been publicly disclosed and may be used. There is no KEV listing and no cited evidence of active exploitation. Exploitation requires remote access, high privileges, and a victim user interaction path consistent with stored XSS.
Researcher notes
Evidence is limited to CVE/VulDB-style reporting. The affected component and parameter are named, but no authoritative patch, fixed version, or active exploitation evidence is provided. Because the project does not use versioning, commit-based validation is more reliable than version checks.
Mitigation direction
- Identify whether Books_Manager is deployed in any environment.
- Restrict access to Books_Manager to trusted networks and users.
- Review vendor or project repository guidance for fixes or safe commits.
- Sanitize and encode user-controlled fields, especially the mark parameter.
- Consider disabling affected book-add functionality until validated safe.
Validation and detection
- Inventory deployed Books_Manager code and compare against commit 298ba736387ca37810466349af13a0fdf828e99c.
- Review add_book_check.php handling of the mark argument.
- Check whether stored book metadata is rendered without output encoding.
- Look for unexpected script-like content in book records or audit logs.
- Confirm whether upstream has published a corrected commit or advisory.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1444 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
4.8MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- VDB-342873 | iJason-Liu Books_Manager add_book_check.php cross site scriptingCVE reference · vdb-entry, technical-description
- VDB-342873 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #736968 | https://github.com/iJason-Liu/Books_Manager Books_Manager 1.0 Stored XSSCVE reference · third-party-advisory
- https://blog.y1fan.work/2026/01/13/%E5%AD%98%E5%82%A8%E5%9E%8Bxss/CVE reference · broken-link, exploit
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.