CVE-2026-24903 — OrcaStatLLM Researcher Stored Cross-Site Scripting (XSS) via Log Message Injection in Session Page
OrcaStatLLM Researcher is an LLM Based Research Paper Generator. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Log Message in the Session Page in Orca…
Published: 2026-02-06 · CVSS: 5.3 · CVSS 4.0
OrcaStatLLM Researcher is an LLM Based Research Paper Generator. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Log Message in the Session Page in OrcaStatLLM-Researcher that allows attackers to inject and execute arbitrary JavaScript code in victims' browsers through malicious research topic inputs.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7