SEPTEMBER 20, 2026
Live Feed
Back to database
Case File

CVE-2026-67352

HIGH · CVSS 7.6 EPSS 0.21% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-01 · Last synced 2026-08-31

CyberRota Analysis

AI-Generated

A stored cross-site scripting vulnerability exists in the resolver_url parameter of the luci-app-https-dns-proxy, affecting Java applications. This flaw allows authenticated users to inject malicious HTML, which executes JavaScript in the browser of an administrator viewing the status page, potentially leading to unauthorized actions or data exposure. Organizations using this application should prioritize patching to mitigate the risk of exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-67352
Severity
HIGH
CVSS
7.6
EPSS
0.21%
Java

Original NVD Description

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.