Medium severity · published Mar 25, 2026
CVE-2026-1001
Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint
4.8
CVSS
0.2%
EPSS
No
On KEV
Description
Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface that allows authenticated administrators to execute arbitrary scripts by supplying crafted names containing script or HTML markup. Attackers can inject malicious code that is stored and rendered without proper output encoding, causing script execution in the browsers of users viewing the affected page and enabling unauthorized actions within their session context.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Domoticz · Domoticz
before 2026.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1001
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1001
Release Notes
https://www.domoticz.com/2026.1/
Third Party Advisory
https://www.vulncheck.com/advisories/domoticz-stored-xss-via-hardware-configuration-endpoint
More from Domoticz
9.8
CVE-2019-10664
Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp
7.5
CVE-2026-71265
Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy()
7.5
CVE-2019-10678
Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options
5.4
CVE-2026-75520
Domoticz: Missing authorization and path traversal in the udevices Lua parser handler
5.4
CVE-2019-15480
Domoticz 4.10717 has XSS via item.Name