Dianping CAT CVE-2026-124506

Exploitation requires the attacker to deliver a crafted request whose 'domain' argument is reflected unsanitized by Model.getDomain into the hourlyReport.tag view of the CAT Report Handler, and requires a victim with access to the CAT web interface to open the attacker-supplied link (CVSS UI:P - passive user interaction). No authentication is needed by the attacker to craft the request (PR:N), and no special non-default configuration is cited in the source. Limiting factors: the reflected (not stored) nature means each victim must individually trigger the crafted URL, impact is confined to the browser session of a CAT dashboard user, and affected versions are specifically 3.0.0, 3.1.0, and 4.0-RC1. No fixed version is available - the vendor did not respond to the disclosure, so no patch is referenced in the sources.

This is a medium-severity reflected cross-site scripting issue (CVSS 4.0 base 5.3) rather than a top-tier emergency. The signals are internally consistent and point to moderate, not critical, urgency: the CVSS vector is AV:N/AC:L/AT:N/PR:N/UI:P, meaning the attack is remote and unauthenticated but REQUIRES victim interaction (UI:P), and impact is limited to VI:L (low integrity) with no confidentiality or availability impact in the vendor-supplied score. Exploit maturity is E:P (proof-of-concept), the description states the exploit has been publicly disclosed, and the vuln.today Decision label is 'this_month' - not act_now or emergency - which aligns with a disclosed-but-not-mass-exploited XSS. It is NOT in CISA KEV (no confirmed active exploitation), and no EPSS probability was provided in the input, so widespread-exploitation likelihood cannot be quantified from this data. The limiting factors (required user interaction, a niche monitoring product, and a reflected rather than stored sink) keep real-world risk moderate. One caveat for defenders: the vendor was contacted but did not respond, so no patch is referenced - remediation options are constrained, which raises operational (not exploitation) risk for exposed deployments.

An attacker crafts a URL for a Dianping CAT instance that embeds a malicious script in the 'domain' parameter handled by Model.getDomain in the hourlyReport.tag report view. The attacker sends this link to a user with access to the CAT monitoring dashboard; when the victim opens it, the unsanitized value is reflected into the page and the script runs in the victim's browser session. A public PoC reference exists; it is not verified as working exploit code.