LEX Baza Dokumentów patches DOM XSS flaw
A DOM-based XSS vulnerability in LEX Baza Dokumentów's cookie handling was patched in version 1.3.4, though CERT Polska rates the exploitation risk as minimal.
CERT Polska coordinated disclosure of CVE-2026-1493, a DOM-based cross-site scripting vulnerability in LEX Baza Dokumentów software. The flaw resides in the application's client-side processing of the "em" cookie parameter, which could allow an attacker to execute arbitrary JavaScript in a victim's browser context.
The vulnerability requires an attacker to have the ability to set cookies, significantly limiting the attack surface. CERT Polska assessed the impact and exploitation risk as minimal due to these constraints. Despite the low risk profile, the vendor acknowledged the issue as a security concern and released version 1.3.4 to address it.
The vulnerability was responsibly reported by Marek Figielski of Vanilla.pl and fixed through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-1493
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free