CVE-2026-1001
Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint
- State
- Published
- Severity
- 4.8 Medium
- Published
- Mar 25, 2026
- Updated
- Jul 14, 2026
- Reserved
- Jan 15, 2026
Description
Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface that allows authenticated administrators to execute arbitrary scripts by supplying crafted names containing script or HTML markup. Attackers can inject malicious code that is stored and rendered without proper output encoding, causing script execution in the browsers of users viewing the affected page and enabling unauthorized actions within their session context.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
DomoticzDomoticz |
|
References
- https://www.domoticz.com/2026.1/release-notespatch
- https://www.vulncheck.com/advisories/domoticz-stored-xss-via-hardware-configuration-endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.