EUVD-2026-80036
GHSA-pgr6-p5qf-2942
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is later processed by the affected handlers.'
AnalysisAI
Stored cross-site scripting in the Netcore NR255-V router (firmware 1.5.130703) lets an authenticated administrator persist malicious JavaScript inside a QoS rule name, which the qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi and qos_filter_show_cgi handlers later pass to eval() without sanitisation. The injected script runs in the browser of any administrator who subsequently opens the affected QoS pages, allowing session theft, credential capture, or silent reconfiguration of the device through the victim's authenticated session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today