CVE-2026-76858

Name of the Vulnerable Software and Affected Versions Netcore NR255-V version 1.5.130703

Description A stored cross-site scripting issue exists in the 'ddns wan list show.cgi' endpoint. The flaw is caused by the unsafe use of the eval() function when handling DDNS data. An attacker can inject a malicious script through the DDNS configuration path, which results in the persistent execution of the script whenever the affected page is accessed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.