Vulnerability · Published Mar 19, 2026 · Assigned by VulnCheck
CVE-2026-32843Linkit ONE Location Aware Sensor System (LASS) Reflected XSS via PM25.php
Medium 5.1
In plain English
A medium-severity cross-site scripting in Location Aware Sensor System (LASS) from LinkItONEDevGroup. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Official description
Location Aware Sensor System by Linkit ONE, up to commit f06bd20 (2023-04-26), contains a reflected cross-site scripting vulnerability in the PM25.php file that allows remote attackers to execute arbitrary JavaScript by injecting malicious code into GET parameters. Attackers can craft a malicious URL containing unencoded payloads in the site, city, district, channel, or apikey parameters to execute scripts in victims' browsers when they visit the page.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LinkItONEDevGroup | Location Aware Sensor System (LASS) | 0 – through f06bd202f37f2a8fafe932feabcb119a292f016e |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N