CVE-2026-76864 — Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule Names
NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_c…
Published: 2026-09-15 · CVSS: 4.8 · CVSS 4.0
NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is later processed by the affected handlers.'
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7