CVE-2026-55730

UNKNOWN 0.0

Loytec LWEB802: Reflected Cross-Site Scripting in LWEB802

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious `project` or `mspParams` parameter.

CWE	CWE-79 CWE-116
Vendor	loytec
Product	lweb-802
Published	Jul 24, 2026
Last Updated	Jul 24, 2026

Stay Ahead of the Next One

Get instant alerts for loytec lweb-802

Be the first to know when new unknown vulnerabilities affecting loytec lweb-802 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Loytec / LWEB-802

0 < 5.0.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

loytec.com: https://www.loytec.com/support/product-security/advisories/8527-dibt-cve-20260601-0002-reflected-cross-site-scripting-xss-high

Credits

Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus