EUVD-2026-49724
Cross-site Scripting (XSS) (CWE-79)
GHSA-8p37-9vwg-qhv8
5.1
CVSS 4.0 · Vendor: jpcert
Share
Severity by source
Vendor (jpcert)
PRIMARY
5.1
MEDIUM
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (jpcert) · only source for this CVE.
CVSS VectorVendor: jpcert
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X
Lifecycle Timeline
1
Analysis Generated
Jul 28, 2026 - 09:33 vuln.today
DescriptionCVE.org
ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
AnalysisAI
Reflected cross-site scripting in the WebUI of ELECOM wireless LAN routers and access points allows an attacker on the adjacent network to execute arbitrary scripts in the browser of a logged-in user, potentially leading to session hijacking or unauthorized admin actions. The vulnerability is reachable via crafted links and requires user interaction. No known public exploit code or active exploitation reported.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).