Stored Cross-Site Scripting Vulnerability in DumbAssets by DumbWare

CVE-2026-45231

What is CVE-2026-45231?

DumbAssets versions prior to 1.0.12 are susceptible to a stored cross-site scripting vulnerability in several asset fields, such as name, description, modelNumber, serialNumber, and tags. These fields lack server-side sanitization, allowing attackers to exploit the asset API endpoints. By injecting HTML or JavaScript payloads, malicious actors can execute scripts within users' browsers when they access the asset list. This exposure potentially enables unauthorized connections to internal network services, particularly when Content-Security-Policy is not enforced.

References