CVE-2026-55730

Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious `project` or `mspParams` parameter.

CVSS 4.0

8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS

0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-25)

CWEs

CWE-79, CWE-116

Published

2026-07-24

Modified

2026-10-24

Record from

the NVD, synced 2026-10-24

References

• https://www.loytec.com/support/product-security/advisories/8527-dibt-cve-20260601-0002-reflected-cross-site-scripting-xss-high

Check your stackJSON