CVE-2026-126798

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126798
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126798.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126798
Published
2026-11-11T20:53:03Z
Modified
2026-11-12T10:45:34Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
NextScan 1.1.0 through 1.2.0 Stored XSS via URL Asset Detail View
Details

NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126798.json"
}
References

Affected packages

Git / github.com/tongcheng-security-team/nextscan

Affected ranges

Type
GIT
Repo
https://github.com/tongcheng-security-team/nextscan
Events
Introduced
ec4f1977523fc62dfd1dc7487dbfa08848dba5dd
Last Affected
a4d87b7651ca923a3b21d3c80ab07735c7210563
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.1.0"
                },
                {
                    "last_affected": "1.2.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

v1.*
v1.1.0
v1.1.1
v1.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126798.json"