Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-35403

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 15.10 to before 27.0.3 and 28.0.1, there is a potential for a cross-site scripting attack in the survey_accounts module if a user provides an invalid visit label. While the data is properly JSON encoded, the Content-Type header is not set causing the web browser to interpret the payload as HTML, opening the possibility of a cross-site scripting if a user is tricked into following an invalid link. This vulnerability is fixed in 27.0.3 and 28.0.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 9.6%
CVSS Severity
CVSS v3 Score 6.5
Products affected by CVE-2026-35403
  • Mcgill » Loris » Version: 15.10
    cpe:2.3:a:mcgill:loris:15.10
  • Mcgill » Loris » Version: 15.10.1
    cpe:2.3:a:mcgill:loris:15.10.1
  • Mcgill » Loris » Version: 15.10.2
    cpe:2.3:a:mcgill:loris:15.10.2
  • Mcgill » Loris » Version: 16.0.0
    cpe:2.3:a:mcgill:loris:16.0.0
  • Mcgill » Loris » Version: 16.0.1
    cpe:2.3:a:mcgill:loris:16.0.1
  • Mcgill » Loris » Version: 16.0.2
    cpe:2.3:a:mcgill:loris:16.0.2
  • Mcgill » Loris » Version: 16.1.0
    cpe:2.3:a:mcgill:loris:16.1.0
  • Mcgill » Loris » Version: 16.1.1
    cpe:2.3:a:mcgill:loris:16.1.1
  • Mcgill » Loris » Version: 16.1.2
    cpe:2.3:a:mcgill:loris:16.1.2
  • Mcgill » Loris » Version: 16.1.3
    cpe:2.3:a:mcgill:loris:16.1.3
  • Mcgill » Loris » Version: 17.0.0
    cpe:2.3:a:mcgill:loris:17.0.0
  • Mcgill » Loris » Version: 17.0.1
    cpe:2.3:a:mcgill:loris:17.0.1
  • Mcgill » Loris » Version: 17.0.2
    cpe:2.3:a:mcgill:loris:17.0.2
  • Mcgill » Loris » Version: 17.0.3
    cpe:2.3:a:mcgill:loris:17.0.3
  • Mcgill » Loris » Version: 17.0.4
    cpe:2.3:a:mcgill:loris:17.0.4
  • Mcgill » Loris » Version: 17.0.5
    cpe:2.3:a:mcgill:loris:17.0.5
  • Mcgill » Loris » Version: 17.0.6
    cpe:2.3:a:mcgill:loris:17.0.6
  • Mcgill » Loris » Version: 18.0.0
    cpe:2.3:a:mcgill:loris:18.0.0
  • Mcgill » Loris » Version: 18.0.1
    cpe:2.3:a:mcgill:loris:18.0.1
  • Mcgill » Loris » Version: 18.0.2
    cpe:2.3:a:mcgill:loris:18.0.2
  • Mcgill » Loris » Version: 18.0.3
    cpe:2.3:a:mcgill:loris:18.0.3
  • Mcgill » Loris » Version: 18.0.4
    cpe:2.3:a:mcgill:loris:18.0.4
  • Mcgill » Loris » Version: 18.0.5
    cpe:2.3:a:mcgill:loris:18.0.5
  • Mcgill » Loris » Version: 19.0.0
    cpe:2.3:a:mcgill:loris:19.0.0
  • Mcgill » Loris » Version: 19.0.1
    cpe:2.3:a:mcgill:loris:19.0.1
  • Mcgill » Loris » Version: 19.0.2
    cpe:2.3:a:mcgill:loris:19.0.2
  • Mcgill » Loris » Version: 19.1.0
    cpe:2.3:a:mcgill:loris:19.1.0
  • Mcgill » Loris » Version: 19.1.1
    cpe:2.3:a:mcgill:loris:19.1.1
  • Mcgill » Loris » Version: 19.1.2
    cpe:2.3:a:mcgill:loris:19.1.2
  • Mcgill » Loris » Version: 20.0.0
    cpe:2.3:a:mcgill:loris:20.0.0
  • Mcgill » Loris » Version: 20.0.1
    cpe:2.3:a:mcgill:loris:20.0.1
  • Mcgill » Loris » Version: 20.0.2
    cpe:2.3:a:mcgill:loris:20.0.2
  • Mcgill » Loris » Version: 20.1.0
    cpe:2.3:a:mcgill:loris:20.1.0
  • Mcgill » Loris » Version: 20.1.1
    cpe:2.3:a:mcgill:loris:20.1.1
  • Mcgill » Loris » Version: 20.1.2
    cpe:2.3:a:mcgill:loris:20.1.2
  • Mcgill » Loris » Version: 20.2.0
    cpe:2.3:a:mcgill:loris:20.2.0
  • Mcgill » Loris » Version: 20.2.1
    cpe:2.3:a:mcgill:loris:20.2.1
  • Mcgill » Loris » Version: 20.3.0
    cpe:2.3:a:mcgill:loris:20.3.0
  • Mcgill » Loris » Version: 20.3.1
    cpe:2.3:a:mcgill:loris:20.3.1
  • Mcgill » Loris » Version: 21.0.0
    cpe:2.3:a:mcgill:loris:21.0.0
  • Mcgill » Loris » Version: 21.0.1
    cpe:2.3:a:mcgill:loris:21.0.1
  • Mcgill » Loris » Version: 21.0.2
    cpe:2.3:a:mcgill:loris:21.0.2
  • Mcgill » Loris » Version: 21.0.3
    cpe:2.3:a:mcgill:loris:21.0.3
  • Mcgill » Loris » Version: 21.0.4
    cpe:2.3:a:mcgill:loris:21.0.4
  • Mcgill » Loris » Version: 21.0.5
    cpe:2.3:a:mcgill:loris:21.0.5
  • Mcgill » Loris » Version: 21.0.6
    cpe:2.3:a:mcgill:loris:21.0.6
  • Mcgill » Loris » Version: 21.0.7
    cpe:2.3:a:mcgill:loris:21.0.7
  • Mcgill » Loris » Version: 22.0.0
    cpe:2.3:a:mcgill:loris:22.0.0
  • Mcgill » Loris » Version: 22.0.1
    cpe:2.3:a:mcgill:loris:22.0.1
  • Mcgill » Loris » Version: 22.0.2
    cpe:2.3:a:mcgill:loris:22.0.2
  • Mcgill » Loris » Version: 22.0.3
    cpe:2.3:a:mcgill:loris:22.0.3
  • Mcgill » Loris » Version: 22.0.4
    cpe:2.3:a:mcgill:loris:22.0.4
  • Mcgill » Loris » Version: 23.0.0
    cpe:2.3:a:mcgill:loris:23.0.0
  • Mcgill » Loris » Version: 23.0.1
    cpe:2.3:a:mcgill:loris:23.0.1
  • Mcgill » Loris » Version: 23.0.10
    cpe:2.3:a:mcgill:loris:23.0.10
  • Mcgill » Loris » Version: 23.0.11
    cpe:2.3:a:mcgill:loris:23.0.11
  • Mcgill » Loris » Version: 23.0.12
    cpe:2.3:a:mcgill:loris:23.0.12
  • Mcgill » Loris » Version: 23.0.2
    cpe:2.3:a:mcgill:loris:23.0.2
  • Mcgill » Loris » Version: 23.0.3
    cpe:2.3:a:mcgill:loris:23.0.3
  • Mcgill » Loris » Version: 23.0.4
    cpe:2.3:a:mcgill:loris:23.0.4
  • Mcgill » Loris » Version: 23.0.5
    cpe:2.3:a:mcgill:loris:23.0.5
  • Mcgill » Loris » Version: 23.0.6
    cpe:2.3:a:mcgill:loris:23.0.6
  • Mcgill » Loris » Version: 23.0.7
    cpe:2.3:a:mcgill:loris:23.0.7
  • Mcgill » Loris » Version: 23.0.8
    cpe:2.3:a:mcgill:loris:23.0.8
  • Mcgill » Loris » Version: 23.0.9
    cpe:2.3:a:mcgill:loris:23.0.9
  • Mcgill » Loris » Version: 24.0.0
    cpe:2.3:a:mcgill:loris:24.0.0
  • Mcgill » Loris » Version: 24.0.1
    cpe:2.3:a:mcgill:loris:24.0.1
  • Mcgill » Loris » Version: 24.0.2
    cpe:2.3:a:mcgill:loris:24.0.2
  • Mcgill » Loris » Version: 24.0.3
    cpe:2.3:a:mcgill:loris:24.0.3
  • Mcgill » Loris » Version: 24.1.0
    cpe:2.3:a:mcgill:loris:24.1.0
  • Mcgill » Loris » Version: 24.1.1
    cpe:2.3:a:mcgill:loris:24.1.1
  • Mcgill » Loris » Version: 24.1.2
    cpe:2.3:a:mcgill:loris:24.1.2
  • Mcgill » Loris » Version: 24.1.3
    cpe:2.3:a:mcgill:loris:24.1.3
  • Mcgill » Loris » Version: 24.1.4
    cpe:2.3:a:mcgill:loris:24.1.4
  • Mcgill » Loris » Version: 24.1.5
    cpe:2.3:a:mcgill:loris:24.1.5
  • Mcgill » Loris » Version: 24.1.6
    cpe:2.3:a:mcgill:loris:24.1.6
  • Mcgill » Loris » Version: 24.1.7
    cpe:2.3:a:mcgill:loris:24.1.7
  • Mcgill » Loris » Version: 24.1.8
    cpe:2.3:a:mcgill:loris:24.1.8
  • Mcgill » Loris » Version: 25.0.0
    cpe:2.3:a:mcgill:loris:25.0.0
  • Mcgill » Loris » Version: 25.0.1
    cpe:2.3:a:mcgill:loris:25.0.1
  • Mcgill » Loris » Version: 25.0.2
    cpe:2.3:a:mcgill:loris:25.0.2
  • Mcgill » Loris » Version: 26.0.0
    cpe:2.3:a:mcgill:loris:26.0.0
  • Mcgill » Loris » Version: 26.0.1
    cpe:2.3:a:mcgill:loris:26.0.1
  • Mcgill » Loris » Version: 26.0.2
    cpe:2.3:a:mcgill:loris:26.0.2
  • Mcgill » Loris » Version: 26.0.3
    cpe:2.3:a:mcgill:loris:26.0.3
  • Mcgill » Loris » Version: 26.0.4
    cpe:2.3:a:mcgill:loris:26.0.4
  • Mcgill » Loris » Version: 26.0.5
    cpe:2.3:a:mcgill:loris:26.0.5
  • Mcgill » Loris » Version: 27.0.0
    cpe:2.3:a:mcgill:loris:27.0.0
  • Mcgill » Loris » Version: 27.0.1
    cpe:2.3:a:mcgill:loris:27.0.1
  • Mcgill » Loris » Version: 27.0.2
    cpe:2.3:a:mcgill:loris:27.0.2
  • Mcgill » Loris » Version: 28.0.0
    cpe:2.3:a:mcgill:loris:28.0.0


Products
Pricing
Contact Us

Shodan ® - All rights reserved