What’s Vulnerable › Vulnerabilities

CVE-2026-1183: HTML injection in multiple Botble products

• Severity: medium (CVSS 5.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-20 · updated 2026-06-17
• Weakness: CWE-79

Description

HTML injection vulnerability in multiple Botble products such as TransP, Athena, Martfury, and Homzen, consisting of an HTML injection due to a lack of proper validation of user input by sending a request to '/search' using the 'q' parameter.

Affected products

• Botble Athena: all versions
• Botble Homzen: all versions
• Botble Martfury: all versions
• Botble TransP: all versions

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/html-injection-multiple-botble-products

Get alerted when CVE-2026-1183 or the next vulnerability affects your stack