Stored Cross-Site Scripting in 1xxx Series NVR Devices by XYZ Corp

CVE-2026-6824

What is CVE-2026-6824?

A stored cross-site scripting vulnerability is present in certain 1xxx series NVR devices manufactured by XYZ Corp. This flaw arises from inadequate sanitization of user-supplied input across specific functional modules. By exploiting this weakness, attackers can embed malicious scripts that are persistently stored within the device's backend. Consequently, when administrators or users access the compromised pages, the scripts execute within their browsers, which poses serious risks such as session hijacking, unauthorized actions on the device, or even the theft of sensitive data.

References