Executive brief
Destekz, a web application developed by Raera, is vulnerable to a security flaw that allows attackers to inject malicious scripts into the pages viewed by other users. This type of attack, known as Cross-Site Scripting (XSS), typically occurs when a user clicks a specially crafted link, potentially leading to the theft of session cookies or unauthorized actions performed in the user's browser. The vendor has stated that this product is no longer supported, meaning no official security updates will be released to fix this issue.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Raera Destekz through version 02062026. The application fails to properly sanitize or neutralize user-provided input before including it in dynamically generated web pages. An unauthenticated remote attacker can exploit this by tricking a user into clicking a malicious link containing a crafted payload. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, which can lead to session hijacking or unauthorized data access. The vendor has confirmed the product is End-of-Life (EOL) and no patch is available.
Affected products
- Raera - Ankara Web Design and Digital Advertising Agency Destekz through 02062026
Timeline
- 2026-07-03: advisory: NVD publication date
- 2026-07-03: disclosed: TR-CERT advisory published