PT-2026-67336

CVE-2026-68583

Published

2026-08-02

Updated

2026-08-02

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions luci-app-adblock-fast versions prior to 1.2.4-4

Description A stored cross-site scripting issue exists in the blocklist name field, specifically involving the file url.name variable. This allows users with lower privileges to inject active HTML. The injected payload executes within the administrator's browser under the LuCI origin when the administrator accesses the AdBlock Fast status page.

Recommendations Update luci-app-adblock-fast to version 1.2.4-4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Lujiefsi

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers