XSS in Xmlrpc-C

CVE-2026-15928

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (20.7th percentile) — read the EPSS interpretation.

Affected products

Xmlrpc-c — versions 1.07

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

vdp@themissinglink.com.au (vendor-advisory)
vdp@themissinglink.com.au (third-party-advisory)