CVE-2026-11425

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11425", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-06-05T20:26:48.616Z", "datePublished": "2026-08-07T20:20:09.402Z", "dateUpdated": "2026-08-17T16:18:03.176Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-14T16:49:37.672Z"}, "title": "Domoticz Mobile Dashboard versions prior to 2026.3 Stored XSS via Text/Alert Device Rendering", "descriptions": [{"lang": "en", "value": "Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via ng-bind-html with only an nl2br() transform that performs no HTML escaping, allowing attackers to store malicious payloads that execute in any administrator's browser upon viewing the mobile dashboard, enabling session cookie theft and account takeover."}], "datePublic": "2026-08-07T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "affected": [{"defaultStatus": "affected", "vendor": "Domoticz", "product": "Domoticz", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThan": "2026.3"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:domoticz:domoticz:*:*:*:*:*:*:*:*", "versionEndExcluding": "2026.3"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 4.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"}}], "references": [{"url": "https://github.com/domoticz/domoticz", "name": "Product Repository", "tags": ["product"]}, {"url": "https://github.com/domoticz/domoticz/commit/f734fde31a4c2ecab3edd825ceb9854719444f64", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/domoticz-mobile-dashboard-versions-prior-to-stored-xss-via-text-alert-device-rendering", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Saidakbarxon Maxsudxonov", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-17T15:39:32.086050Z", "id": "CVE-2026-11425", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-17T16:18:03.176Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11425", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T15:39:32.086050Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-17T16:17:57.296Z"}}], "cna": {"title": "Domoticz Mobile Dashboard versions prior to 2026.3 Stored XSS via Text/Alert Device Rendering", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Saidakbarxon Maxsudxonov"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Domoticz", "product": "Domoticz", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.3", "versionType": "custom"}], "defaultStatus": "affected"}], "datePublic": "2026-08-07T00:00:00.000Z", "references": [{"url": "https://github.com/domoticz/domoticz", "name": "Product Repository", "tags": ["product"]}, {"url": "https://github.com/domoticz/domoticz/commit/f734fde31a4c2ecab3edd825ceb9854719444f64", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/domoticz-mobile-dashboard-versions-prior-to-stored-xss-via-text-alert-device-rendering", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via ng-bind-html with only an nl2br() transform that performs no HTML escaping, allowing attackers to store malicious payloads that execute in any administrator's browser upon viewing the mobile dashboard, enabling session cookie theft and account takeover."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:domoticz:domoticz:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2026.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-14T16:49:37.672Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11425", "state": "PUBLISHED", "dateUpdated": "2026-08-17T16:18:03.176Z", "dateReserved": "2026-06-05T20:26:48.616Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-07T20:20:09.402Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Domoticz", "vendor": "Domoticz", "versions": [{"lessThan": "2026.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via ng-bind-html with only an nl2br() transform that performs no HTML escaping, allowing attackers to store malicious payloads that execute in any administrator's browser upon viewing the mobile dashboard, enabling session cookie theft and account takeover."}, {"lang": "es", "value": "Las versiones de Domoticz anteriores a 2026.3 contienen una vulnerabilidad de cross-site scripting almacenado en el panel de control m\u00f3vil que permite a atacantes autenticados inyectar HTML y JavaScript arbitrarios actualizando los valores de dispositivos de subtipo Texto o Alerta a trav\u00e9s de la API. El panel de control m\u00f3vil renderiza los datos del dispositivo a trav\u00e9s de ng-bind-html con solo una transformaci\u00f3n nl2br() que no realiza ning\u00fan escape de HTML, permitiendo a los atacantes almacenar cargas \u00fatiles maliciosas que se ejecutan en el navegador de cualquier administrador al ver el panel de control m\u00f3vil, lo que permite el robo de cookies de sesi\u00f3n y la toma de control de la cuenta."}], "id": "CVE-2026-11425", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11425", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-17T15:39:32.086050Z", "version": "2.0.3"}}]}, "published": "2026-08-07T21:17:27.010", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/domoticz/domoticz"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/domoticz/domoticz/commit/f734fde31a4c2ecab3edd825ceb9854719444f64"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/domoticz-mobile-dashboard-versions-prior-to-stored-xss-via-text-alert-device-rendering"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Domoticz: Domoticz: Stored cross-site scripting allows administrator account takeover", "id": "2512665", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512665"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via ng-bind-html with only an nl2br() transform that performs no HTML escaping, allowing attackers to store malicious payloads that execute in any administrator's browser upon viewing the mobile dashboard, enabling session cookie theft and account takeover.", "A flaw was found in Domoticz. An authenticated attacker can exploit a stored cross-site scripting (XSS) vulnerability in the mobile dashboard. This allows the attacker to inject malicious code by updating specific device values through the application's programming interface (API). When an administrator views the mobile dashboard, this malicious code executes in their browser, which could lead to the theft of their session information and ultimately, account takeover."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict network access to the Domoticz API and mobile dashboard to trusted internal networks only. If the mobile dashboard functionality is not required, consider disabling or restricting access to it to prevent exploitation."}, "name": "CVE-2026-11425", "public_date": "2026-08-07T20:20:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-11425\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-11425\nhttps://github.com/domoticz/domoticz\nhttps://github.com/domoticz/domoticz/commit/f734fde31a4c2ecab3edd825ceb9854719444f64\nhttps://www.vulncheck.com/advisories/domoticz-mobile-dashboard-versions-prior-to-stored-xss-via-text-alert-device-rendering"], "statement": "Exploitation requires low-privileged API access to push malicious scripts into device payload fields, which subsequently execute in an administrator's browser upon accessing the mobile dashboard, potentially compromising administrative session confidentiality and system integrity. This vulnerability strictly impacts Confidentiality and Integrity with zero impact on Availability as it does not disrupt service operation. Environments operating without mobile dashboard usage or where device updating APIs are strictly restricted to trusted internal networks remain unaffected.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2026.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Domoticz", "source": "cna", "vendor": "Domoticz"}, "product": "domoticz", "vendor": "domoticz"}], "created": "2026-08-07T21:30:17.981941+00:00", "updated": "2026-08-07T21:30:18.186134+00:00", "vendors": ["domoticz", "domoticz$PRODUCT$domoticz"]}