Cross Site Scripting Vulnerability in Dianping CAT Reporting Component
CVE-2026-124506

5.3MEDIUM

Key Information:

Vendor

Dianping

Status
Cat
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124506?

A cross site scripting vulnerability has been identified in the Dianping CAT's Report Handler component, specifically in the Model.getDomain function located in the hourlyReport.tag file. This vulnerability allows attackers to exploit the application remotely by manipulating the domain argument, potentially compromising the integrity of user sessions and leading to unauthorized access to sensitive information. The exploit has been made public, highlighting the urgency for users to implement patches or mitigations to protect their applications.

Affected Version(s)

CAT 3.0.0

CAT 3.1.0

CAT 4.0-RC1

References

https://vuldb.com/vuln/432810
vdb-entrytechnical-description
https://vuldb.com/vuln/432810/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124506
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lucasg2g (VulDB User)
VulDB CNA Team
.