PT-2026-145455
CVE-2026-126798
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
CVSS 3.1
4.7
MediumMetricsAV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators.
Found an issue in the description? Have something to add? Feel free to write us 👾