MEDIUM 6.8 NVD
CVE-2026-67352
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTM
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.
References
- https://github.com/openwrt/luci/security/advisories/GHSA-c6vf-395q-4jv6
- https://www.vulncheck.com/advisories/luci-app-https-dns-proxy-stored-xss-via-resolver-url
This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-08-01 via NVD.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.