MEDIUMCVSS v3.1 4.7Vulnerability
CVE-2026-126798
NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Cvss score
- 4.7
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-11T23:50:18+00:00
- Score
- 4.7
- Last source
- NVD
- Cvss version
- 3.1
- Cve id
- CVE-2026-126798
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- First seen by Signal
- 2026-11-11T23:46:41+00:00
- Name
- CVE-2026-126798
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Published at
- 2026-11-11T21:16:43.190
- Last modified
- 2026-11-11T21:16:43.190
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph