Stored Cross-Site Scripting in Netcore NR255-V Affecting L7 Content Management
CVE-2026-92257

5.1MEDIUM

Key Information:

Vendor

Netcore

Status
Nr255-v
Vendor
CVE Published:
15 September 2026

What is CVE-2026-92257?

The Netcore NR255-V version 1.5.130703 is susceptible to a stored cross-site scripting vulnerability that arises from the use of eval() sinks in L7 content management pages. This vulnerability allows attackers to inject persistent script payloads into the affected call board text and policy group handling components. When users interact with these components, they can unknowingly execute malicious scripts within their browsers, potentially compromising their data and session integrity.

Affected Version(s)

NR255-V 1.5.130703

References

https://github.com/draw-ctf/netcore-router-public-refs/bl...
third-party-advisory
https://www.vulncheck.com/advisories/netcore-nr255-v-1.5....
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhou Ao
Yin Luxing
Jiang Yuxuan
Liu Xin
@Nebusec
.