Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
LockerProject Locker Allows Hackers to Inject Malicious Code via IDs
CVE-2026-3951
Summary
A security flaw in LockerProject Locker allows hackers to inject malicious code into a website, potentially stealing sensitive information or taking control of user accounts. This flaw can be exploited remotely, and an exploit is already available. It's recommended to update to the latest version of LockerProject Locker as soon as possible to protect your website from potential attacks.
Original title
A security flaw has been discovered in LockerProject Locker 0.0.0/0.0.1/0.1.0. Affected is the function authIsAwesome of the file source-code/Locker-master/Ops/registry.js of the component Error Re...
Original description
A security flaw has been discovered in LockerProject Locker 0.0.0/0.0.1/0.1.0. Affected is the function authIsAwesome of the file source-code/Locker-master/Ops/registry.js of the component Error Response Handler. The manipulation of the argument ID results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
nvd CVSS2.0
5.0
nvd CVSS3.1
4.3
nvd CVSS4.0
5.3
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
CWE-94
Code Injection
Published: 11 Mar 2026 · Updated: 13 Mar 2026 · First seen: 11 Mar 2026