CVE-2026-1001

MediumCVSS 4.8/10Last modified Jul 14, 2026

Description

Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface that allows authenticated administrators to execute arbitrary scripts by supplying crafted names containing script or HTML markup. Attackers can inject malicious code that is stored and rendered without proper output encoding, causing script execution in the browsers of users viewing the affected page and enabling unauthorized actions within their session context.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 25, 2026
Last modified: Jul 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-100105.0Inappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the CVE-2026-1001029.5Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to thi CVE-2026-10010310.0Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unau CVE-2026-1001043.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th CVE-2026-1001066.4The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' para CVE-2026-1001077.2The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up t CVE-2026-1001086.4The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter i CVE-2026-100113.1Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer pro CVE-2026-1001117.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cu CVE-2026-1001127.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cu CVE-2026-1001137.5CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacke CVE-2026-1001147.5CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker