CVE-2026-76864

Name of the Vulnerable Software and Affected Versions NR255-V version 1.5.130703

Description Stored Cross-Site Scripting occurs because the software fails to sanitize QoS rule names before they are parsed using the eval() function. This issue affects the qos xianz add cgi, qos xianz show cgi, qos filter add cgi, and qos filter show cgi handlers. An attacker can inject persistent script code through a crafted QoS rule name that executes when the stored data is processed by these handlers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.