processes the parameter on the client side, allowing an attacker to execute arbitrary
JavaScript in the context of the victim's browser.
An attacker with ability to set a cookie can perform a more severe attack, so we evaluate the impact and risk of exploitation as minimal. However, the vendor considered this a vulnerability and released a security patch.
This issue was fixed in version 1.3.4.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Wolters Kluwer Polska | LEX Baza Dokumentów | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Thu, 30 Apr 2026 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | LEX Baza Dokumentów is vulnerable to DOM-based XSS in "em" cookie parameter. The application unsafely processes the parameter on the client side, allowing an attacker to execute arbitrary JavaScript in the context of the victim's browser. An attacker with ability to set a cookie can perform a more severe attack, so we evaluate the impact and risk of exploitation as minimal. However, the vendor considered this a vulnerability and released a security patch. This issue was fixed in version 1.3.4. | |
| Title | Cross-Site Scripting in LEX Baza Dokumentów | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published:
Updated: 2026-04-30T11:24:30.615Z
Reserved: 2026-01-27T14:52:25.033Z
Link: CVE-2026-1493
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-30T12:16:23.120
Modified: 2026-04-30T12:16:23.120
Link: CVE-2026-1493
Redhat
No data.
OpenCVE Enrichment
No data.