# CVE-2026-58205 - GRR < 4.5.0 reflected XSS: installation/maj.php echoes the 'forcemaj'
# request parameter into the HTML response without escaping (when installation files remain
# accessible), so an unauthenticated attacker can reflect script into a victim's browser.
# This matches a request to maj.php whose forcemaj value carries an HTML/script payload.
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-58205 GRR - maj.php forcemaj Reflected XSS"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/installation/maj.php"; nocase; fast_pattern; content:"forcemaj="; nocase; pcre:"/forcemaj=[^&]*(?:%3c|<)\s*(?:svg|script|img|iframe|body|on\w+\s*(?:%3d|=))/i"; classtype:web-application-attack; reference:cve,CVE-2026-58205; reference:url,https://www.exploit.observer/?keyword=CVE-2026-58205&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=grr&match=exact; sid:1098600; rev:1;)