CVE-2026-11425CWE-79cross-site-scripting

CVE-2026-11425

Medium · published August 8, 2026

CVSS v3.1
4.4
EPSS
0%
Percentile
15.8
In the wild
Unconfirmed
What it is

Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via ng-bind-html with only an nl2br() transform that performs no HTML escaping, allowing attackers to store malicious payloads that execute in any administrator's browser upon viewing the mobile dashboard, enabling session cookie theft and account takeover.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00252 · 15.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-08T01:17Z
References (3)
https://github.com/domoticz/domoticz · [email protected]https://github.com/domoticz/domoticz/commit/f734fde31a4c2ecab3edd825ceb9854719444f64 · [email protected]https://www.vulncheck.com/advisories/domoticz-mobile-dashboard-versions-prior-to-stored-xss-via-text-alert-device-rendering · [email protected]
EPSS history
Timeline
  • 07 AUG 20:20Z
    Domoticz Mobile Dashboard versions prior to 2026.3 Stored XSS via Text/Alert Device Rendering
    cvelistv5