PHP CVE-2026-32843

Q: What is the CVSS score of CVE-2026-32843?

CVE-2026-32843 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-19 disclosure@vulncheck.com

PHP XSS

5.1

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jul 14, 2026 - 19:22 NVD

5.1 (MEDIUM)

Analysis Generated

Mar 20, 2026 - 13:52 vuln.today

CVE Published

Mar 19, 2026 - 15:16 nvd

N/A

DescriptionCVE.org

Location Aware Sensor System by Linkit ONE, up to commit f06bd20 (2023-04-26), contains a reflected cross-site scripting vulnerability in the PM25.php file that allows remote attackers to execute arbitrary JavaScript by injecting malicious code into GET parameters. Attackers can craft a malicious URL containing unencoded payloads in the site, city, district, channel, or apikey parameters to execute scripts in victims' browsers when they visit the page.

AnalysisAI

Linkit ONE Location Aware Sensor System (LASS) up to commit f06bd20 contains reflected cross-site scripting (XSS) in PM25.php that permits remote attackers to execute arbitrary JavaScript in victim browsers through unencoded GET parameters (site, city, district, channel, apikey). The vulnerability affects a sensor data collection platform and carries a low exploitation probability (EPSS 0.21%, percentile 43%), suggesting limited real-world attack activity despite public disclosure through VulnCheck.

Technical ContextAI

The vulnerability is a classic reflected XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in a PHP-based web application. The PM25.php endpoint processes user-supplied GET parameters without proper HTML encoding or output validation, allowing malicious JavaScript payloads to be reflected directly into the HTML response. This affects Linkit ONE's LASS system, which is an environmental sensor data platform designed to aggregate air quality metrics (PM2.5 particulate data). The root cause is the absence of contextual output encoding (e.g., htmlspecialchars() in PHP) when rendering user input in the HTTP response.

Affected ProductsAI

Linkit ONE Location Aware Sensor System (LASS) versions up to commit f06bd20 (dated 2023-04-26) are affected. The vulnerability specifically impacts the PM25.php component within the LASS data collection platform. No CPE string is provided in the available data. Additional version information and patch status can be confirmed through the VulnCheck advisory (https://www.vulncheck.com/advisories/linkit-one-location-aware-sensor-system-lass-reflected-xss-via-pm25-php) and the official repository (https://github.com/LinkItONEDevGroup/LASS/commits/master/).

RemediationAI

Upgrade Linkit ONE LASS to a version released after commit f06bd20 (2023-04-26); consult the GitHub repository to identify the earliest patched release. In the interim, implement contextual output encoding of all GET parameters (site, city, district, channel, apikey) using PHP's htmlspecialchars() or equivalent HTML entity encoding before rendering in HTTP responses. Deploy a Web Application Firewall (WAF) with XSS signature detection on the PM25.php endpoint, enforce Content Security Policy (CSP) headers to restrict inline script execution, and limit access to the PM25.php endpoint to trusted networks where possible. Review VulnCheck and VulnDB advisories (https://vuldb.com/?id.351715) for additional mitigation guidance.