Vulnerability · Published Mar 25, 2026 · Assigned by VulnCheck

CVE-2026-1001Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint

Medium 4.8

In plain English

A medium-severity cross-site scripting in Domoticz from Domoticz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 4.0)4.8Medium

Exploit odds (30 days)0.2%top 90.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface that allows authenticated administrators to execute arbitrary scripts by supplying crafted names containing script or HTML markup. Attackers can inject malicious code that is stored and rendered without proper output encoding, causing script execution in the browsers of users viewing the affected page and enabling unauthorized actions within their session context.

Affected products (as reported)

Vendor	Product	Versions
Domoticz	Domoticz	0 – before 2026.1

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://www.domoticz.com/2026.1/ release-notes, patch
https://www.vulncheck.com/advisories/domoticz-stored-xss-via-hardware-configuration-endpoint third-party-advisory