CVE-2026-32843

5.1 mediumEPSS 0.4%

Medium (5.1). EPSS 0.4% chance of exploitation in the next 30 days.

Location Aware Sensor System by Linkit ONE, up to commit f06bd20 (2023-04-26), contains a reflected cross-site scripting vulnerability in the PM25.php file that allows remote attackers to execute arbitrary JavaScript by injecting malicious code into GET parameters. Attackers can craft a malicious URL containing unencoded payloads in the site, city, district, channel, or apikey parameters to execute scripts in victims' browsers when they visit the page.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-03-19
Modified: 2026-07-14
Record from: the NVD, synced 2026-10-19

References

https://github.com/LinkItONEDevGroup/LASS/commits/master/
https://www.vulncheck.com/advisories/linkit-one-location-aware-sensor-system-lass-reflected-xss-via-pm25-php

Check your stack JSON