Stored Cross-Site Scripting Vulnerability in NextScan by Lysec
CVE-2026-126798

2.1LOW

Key Information:

Vendor

Tongcheng-security-team

Status
Nextscan
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126798?

NextScan versions 1.1.0 through 1.2.0 exhibit a stored cross-site scripting vulnerability within the ns-admin URL asset detail dialog. This weakness allows attackers to inject malicious JavaScript by crafting forms hosted on crawled sites. When users view the asset details, the JavaScript executes through the innerHTML method without proper encoding, potentially enabling attackers to steal localStorage access tokens and hijack user sessions, including administrative accounts.

Affected Version(s)

NextScan 1.1.0 <= 1.2.0

References

https://github.com/tongcheng-security-team/NextScan/issue...
issue-tracking
https://hub.docker.com/r/lysec/ns-admin
product
https://vul.yulun.ac.cn/20261107/nextscan/
third-party-advisory

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wu Yulun
.