Skip to content
Threat Feed
Subscribe

Product

Luci-App-Upnp

1 brief RSS
high advisory

CVE-2026-61875: Stored Cross-Site Scripting in OpenWrt luci-app-upnp

CVE-2026-61875 details a stored cross-site scripting vulnerability in OpenWrt's luci-app-upnp that allows unauthenticated LAN clients to inject malicious JavaScript into UPnP IGD AddPortMapping SOAP requests, leading to client-side code execution in an administrator's browser when viewing specific web interface pages.

luci-app-upnp cross-site-scripting xss openwrt router web-vulnerability client-side-execution
2t 1c