CVE-2026-92257

Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks

State: Published
Severity: 5.1 Medium
Published: Sep 15, 2026
Updated: Sep 21, 2026
Reserved: Sep 15, 2026

Description

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious code executed in the context of other users viewing the affected content.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N	VulnCheck
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
NR255-VNetcore	1.5.130703Affected

References

Netcore router public references: Stored Cross-site Scripting Across L7 Content Management Pages via eval() Sinksthird-party-advisory
VulnCheck Advisory: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinksthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.