CVE-2026-30695

CVE-2026-30695 - Zucchetti Axess 中的 XSS 漏洞 概述 Zucchetti Axess 门禁控制设备（XA4、X3/X3BIO、X4、X7、XIO、i-door、i-door+）的基于 Web 的配置界面中存在跨站脚本（XSS）漏洞。 该漏洞是由于 /filemanager.cgi 端点中的 dirBrowse 参数对用户提供的输入未进行适当的清理所致。经过身份验证的攻击者可以注入任意 JavaScript 代码，这些代码会在管理用户的上下文中执行。 成功利用该漏洞可能导致会话劫持、未经授权的配置更改以及敏感信息泄露。 受影响版本 XIO h06...

CVE-2026-30695

A Cross-Site Scripting XSS vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices, including XA4, X3/X3BIO, X4, X7, and XIO / i-door / i-door+. The vulnerability is caused by improper sanitization of user-supplied input in the dirBrowse parameter o...

CVE-2026-30695

A Cross-Site Scripting (XSS) vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices, specifically affecting models XA4, X3/X3BIO, X4, X7, and XIO / i-door / i-door+ . The flaw is triggered by the improper sanitization of user-supplied input in the ...

CVE-2026-30695: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices, including XA4, X3/X3BIO, X4, X7, and XIO / i-door / i-door+. The vulnerability is caused by improper sanitization of user-supplied input in the dirBrowse parameter o...