XSS in Wolterskluwer Lex Baza Dokumentow
CVE-2026-1493
LEX Baza Dokumentów is vulnerable to DOM-based XSS in "em" cookie parameter. The application unsafely processes the parameter on the client side, allowing an attacker to execute arbitrary JavaScript in the context of the victim's browser. An attacker with ability to set a cookie can perform a more severe attack, so we evaluate the impact and risk of exploitation as minimal. However, the vendor considered this a vulnerability and released a security patch. This issue was fixed in version 1.3.4.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (6.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 7th percentile — 6.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
Weakness classification (CWE)
References
- www.wolterskluwer.com/pl-pl/solutions/lex-baza-dokumentow (Product, product)
- cert.pl/posts/2026/04/CVE-2025-1493 (Broken Link, third-party-advisory)
Frequently asked questions
- What is CVE-2026-1493?
- CVE-2026-1493 is a medium-severity vulnerability in Wolterskluwer Lex Baza Dokumentow, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-04-30.
- How severe is CVE-2026-1493?
- Medium severity. CVSS v3 base score is 5.4 out of 10.