# CVE-2026-12682: Ankaref LIBRID/LIBREF stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-12682-ankaref-librid-libref-stored-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-12682 · Severity: medium · CVSS 5.4 · Published 2026-09-10

Ankaref LIBRID/LIBREF is a library management system used by organizations to catalog and manage digital and physical resources. An attacker can inject malicious JavaScript code that gets stored in the system and then executed in the browsers of users who view affected pages, potentially allowing credential theft, session hijacking, or unauthorized actions on behalf of legitimate users.

Technologies: [Ankaref Innovation and Technology Inc. LIBRID/LIBREF](https://junglewise.ai/threats/technologies/librid-libref). Vendors: [Ankaref Innovation and Technology Inc.](https://junglewise.ai/threats/vendors/ankaref-innovation-and-technology-inc).

## Quick answers

**Is CVE-2026-12682 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12682 being exploited in the wild.

**How severe is CVE-2026-12682?** Medium severity, with a CVSS score of 5.4, published 10 September 2026.

**Which products and versions are affected?** Ankaref Innovation and Technology Inc. LIBRID/LIBREF 2.01.0.2183 to 18.9.26.2318.

**Is there a fix for CVE-2026-12682?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12682 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-12682?** Check whether you run Ankaref Innovation and Technology Inc. LIBRID/LIBREF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a stored cross-site scripting (XSS) flaw in the web page generation functionality of LIBRID/LIBREF. The product fails to properly neutralize user-supplied input before rendering it in web pages, allowing attackers to inject and store arbitrary JavaScript code. An attacker with the ability to submit content to the system can craft malicious payloads that will execute whenever other users access the compromised pages. The vulnerability affects versions 2.01.0.2183 through 18.9.26.2318, with a fix available in version 18.9.26.2319 or later.

## Affected products

- Ankaref Innovation and Technology Inc. LIBRID/LIBREF 2.01.0.2183 to 18.9.26.2318

## Timeline

- 2026-09-10: disclosed

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1064](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1064)

## Related threats

- [Ankaref LIBRID/LIBREF weak password recovery mechanism](https://junglewise.ai/threats/cve-2026-6285-ankaref-librid-libref-weak-password-recovery-mechanism)
- [Ankaref LIBRID/LIBREF stored cross-site scripting in web page generation](https://junglewise.ai/threats/cve-2026-12683-ankaref-librid-libref-stored-cross-site-scripting-in-web-page)