CVE-2026-55730

Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious `project` or `mspParams` parameter.

Score

CVSS 4.0 8.7 High

Status

Deferred - vulnerability@ncsc.ch

Published

2026-07-24

Last modified

2026-10-24

Weaknesses

CWE-116, CWE-79

Affected products

• Lweb-802 (Loytec)

References

• https://www.loytec.com/support/product-security/advisories/8527-dibt-cve-20260601-0002-reflected-cross-site-scripting-x…