# CVE-2026-19727: Yordam Library Information and Document Automation Program cross-site scripting in HTML attributes

Source: https://junglewise.ai/threats/cve-2026-19727-yordam-library-information-and-document-automation-program-cross  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19727 · Severity: medium · CVSS 6.1 · Published 2026-09-04

Yordam Library Information and Document Automation Program is a document management system used by organizations to store and retrieve information. The software fails to properly sanitize user input when generating web pages, allowing attackers to inject malicious scripts that execute in users' browsers. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of affected users.

Technologies: [Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program](https://junglewise.ai/threats/technologies/library-information-and-document-automation-program). Vendors: [Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc.](https://junglewise.ai/threats/vendors/yordam-information-technology-consulting-training-and-electronic-systems-industry-and-trade-inc).

## Quick answers

**Is CVE-2026-19727 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19727 being exploited in the wild.

**How severe is CVE-2026-19727?** Medium severity, with a CVSS score of 6.1, published 4 September 2026.

**Which products and versions are affected?** Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program before v22.2.

**Is there a fix for CVE-2026-19727?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19727 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-19727?** Check whether you run Yordam Information Technology Consulting or Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cross-site scripting (XSS) flaw in Yordam Library Information and Document Automation Program that specifically targets HTML attributes during web page generation. The root cause is improper input neutralization when processing user-supplied data that is reflected back in HTML attribute contexts. This is a stored or reflected XSS attack requiring no authentication; an attacker can craft a malicious URL or inject content that, when viewed by a user, executes arbitrary JavaScript in the victim's browser within the application's security context. The vulnerability affects versions prior to v22.2, and a patch is available in the current version.

## Affected products

- Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program before v22.2

## Timeline

- 2026-09-04: disclosed

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1011](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1011)

## Related threats

- [Yordam Information Technology Library Information and Document Automation Program cross-site scripting](https://junglewise.ai/threats/cve-2026-77818-yordam-information-technology-library-information-and-document)