CVE-2026-28166 Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions

Description

Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.

Affected products and versions

Product	Affected versions	Fixed in
Tourmaster 5.4	earliest → 5.4.9	No fix stated

Other CVEs of Tourmaster

The 4 CVEs of Tourmaster →

CVE-2025-69133 Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions 7.5 High CVE-2025-48292 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in… 8.1 High CVE-2025-32923 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers… 7.1 High