Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-126802 (GCVE-0-2026-126802)

Vulnerability from nvd – Published: 2026-11-11 20:53 – Updated: 2026-11-13 17:47

Title

NextScan 1.1.0 through 1.2.0 Hardcoded Credentials in ns-admin Agent and External APIs

Summary

NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 17:47 UTC

CWE

CWE-798 - Use of Hard-coded Credentials

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8174 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tongcheng-security-team/NextSc…	issue-tracking
https://hub.docker.com/r/lysec/ns-admin	product
https://vul.yulun.ac.cn/20261107/nextscan/	third-party-advisory
https://www.vulncheck.com/advisories/nextscan-1.1…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
tongcheng-security-team	NextScan	Affected: 1.1.0 , ≤ 1.2.0 (semver)

Date Public

2026-11-07 02:23

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126802",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T17:47:03.521361Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T17:47:32.428Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://vul.yulun.ac.cn/20261107/nextscan/"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:docker/lysec/ns-admin",
          "product": "NextScan",
          "vendor": "tongcheng-security-team",
          "versions": [
            {
              "lessThanOrEqual": "1.2.0",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-07T02:23:53.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin\u0027s AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T20:53:06.025Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/tongcheng-security-team/NextScan/issues/50"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://hub.docker.com/r/lysec/ns-admin"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261107/nextscan/"
        },
        {
          "name": "VulnCheck Advisory: NextScan 1.1.0 through 1.2.0 Hardcoded Credentials in ns-admin Agent and External APIs",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-credentials-in-ns-admin-agent-and-external-apis"
        }
      ],
      "title": "NextScan 1.1.0 through 1.2.0 Hardcoded Credentials in ns-admin Agent and External APIs",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126802",
    "datePublished": "2026-11-11T20:53:06.025Z",
    "dateReserved": "2026-11-11T20:01:48.610Z",
    "dateUpdated": "2026-11-13T17:47:32.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126798 (GCVE-0-2026-126798)

Vulnerability from nvd – Published: 2026-11-11 20:53 – Updated: 2026-11-13 17:45

Title

NextScan 1.1.0 through 1.2.0 Stored XSS via URL Asset Detail View

Summary

NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 17:45 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8174 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tongcheng-security-team/NextSc…	issue-tracking
https://hub.docker.com/r/lysec/ns-admin	product
https://vul.yulun.ac.cn/20261107/nextscan/	third-party-advisory
https://www.vulncheck.com/advisories/nextscan-1.1…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
tongcheng-security-team	NextScan	Affected: 1.1.0 , ≤ 1.2.0 (semver)

Date Public

2026-11-07 02:22

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126798",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T17:45:32.680534Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T17:45:51.928Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://vul.yulun.ac.cn/20261107/nextscan/"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:docker/lysec/ns-admin",
          "product": "NextScan",
          "vendor": "tongcheng-security-team",
          "versions": [
            {
              "lessThanOrEqual": "1.2.0",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-07T02:22:31.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T20:53:03.298Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/tongcheng-security-team/NextScan/issues/49"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://hub.docker.com/r/lysec/ns-admin"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261107/nextscan/"
        },
        {
          "name": "VulnCheck Advisory: NextScan 1.1.0 through 1.2.0 Stored XSS via URL Asset Detail View",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-stored-xss-via-url-asset-detail-view"
        }
      ],
      "title": "NextScan 1.1.0 through 1.2.0 Stored XSS via URL Asset Detail View",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126798",
    "datePublished": "2026-11-11T20:53:03.298Z",
    "dateReserved": "2026-11-11T20:01:47.109Z",
    "dateUpdated": "2026-11-13T17:45:51.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126797 (GCVE-0-2026-126797)

Vulnerability from nvd – Published: 2026-11-11 20:53 – Updated: 2026-11-11 20:53

Title

NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin

Summary

NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-321 - Use of Hard-coded Cryptographic Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8174 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/tongcheng-security-team/NextSc…	issue-tracking
https://github.com/tongcheng-security-team/NextSc…	product
https://hub.docker.com/r/lysec/ns-admin	product
https://vul.yulun.ac.cn/20261107/nextscan/	third-party-advisory
https://www.vulncheck.com/advisories/nextscan-1.1…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
tongcheng-security-team	NextScan	Affected: 1.1.0 , ≤ 1.2.0 (semver)

Date Public

2026-11-07 02:20

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:docker/lysec/ns-admin",
          "product": "NextScan",
          "vendor": "tongcheng-security-team",
          "versions": [
            {
              "lessThanOrEqual": "1.2.0",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-07T02:20:53.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "Use of Hard-coded Cryptographic Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T20:53:02.665Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/tongcheng-security-team/NextScan/issues/48"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/tongcheng-security-team/NextScan/blob/v1.2.0/docker/docker-compose.yaml"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://hub.docker.com/r/lysec/ns-admin"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261107/nextscan/"
        },
        {
          "name": "VulnCheck Advisory: NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-jwt-key-authentication-bypass-in-ns-admin"
        }
      ],
      "title": "NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126797",
    "datePublished": "2026-11-11T20:53:02.665Z",
    "dateReserved": "2026-11-11T20:01:46.748Z",
    "dateUpdated": "2026-11-11T20:53:02.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126802 (GCVE-0-2026-126802)

Vulnerability from cvelistv5 – Published: 2026-11-11 20:53 – Updated: 2026-11-13 17:47

Title

NextScan 1.1.0 through 1.2.0 Hardcoded Credentials in ns-admin Agent and External APIs

Summary

NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 17:47 UTC

CWE

CWE-798 - Use of Hard-coded Credentials

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8174 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tongcheng-security-team/NextSc…	issue-tracking
https://hub.docker.com/r/lysec/ns-admin	product
https://vul.yulun.ac.cn/20261107/nextscan/	third-party-advisory
https://www.vulncheck.com/advisories/nextscan-1.1…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
tongcheng-security-team	NextScan	Affected: 1.1.0 , ≤ 1.2.0 (semver)

Date Public

2026-11-07 02:23

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126802",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T17:47:03.521361Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T17:47:32.428Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://vul.yulun.ac.cn/20261107/nextscan/"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:docker/lysec/ns-admin",
          "product": "NextScan",
          "vendor": "tongcheng-security-team",
          "versions": [
            {
              "lessThanOrEqual": "1.2.0",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-07T02:23:53.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin\u0027s AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T20:53:06.025Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/tongcheng-security-team/NextScan/issues/50"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://hub.docker.com/r/lysec/ns-admin"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261107/nextscan/"
        },
        {
          "name": "VulnCheck Advisory: NextScan 1.1.0 through 1.2.0 Hardcoded Credentials in ns-admin Agent and External APIs",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-credentials-in-ns-admin-agent-and-external-apis"
        }
      ],
      "title": "NextScan 1.1.0 through 1.2.0 Hardcoded Credentials in ns-admin Agent and External APIs",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126802",
    "datePublished": "2026-11-11T20:53:06.025Z",
    "dateReserved": "2026-11-11T20:01:48.610Z",
    "dateUpdated": "2026-11-13T17:47:32.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126798 (GCVE-0-2026-126798)

Vulnerability from cvelistv5 – Published: 2026-11-11 20:53 – Updated: 2026-11-13 17:45

Title

NextScan 1.1.0 through 1.2.0 Stored XSS via URL Asset Detail View

Summary

NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 17:45 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8174 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tongcheng-security-team/NextSc…	issue-tracking
https://hub.docker.com/r/lysec/ns-admin	product
https://vul.yulun.ac.cn/20261107/nextscan/	third-party-advisory
https://www.vulncheck.com/advisories/nextscan-1.1…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
tongcheng-security-team	NextScan	Affected: 1.1.0 , ≤ 1.2.0 (semver)

Date Public

2026-11-07 02:22

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126798",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T17:45:32.680534Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T17:45:51.928Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://vul.yulun.ac.cn/20261107/nextscan/"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:docker/lysec/ns-admin",
          "product": "NextScan",
          "vendor": "tongcheng-security-team",
          "versions": [
            {
              "lessThanOrEqual": "1.2.0",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-07T02:22:31.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T20:53:03.298Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/tongcheng-security-team/NextScan/issues/49"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://hub.docker.com/r/lysec/ns-admin"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261107/nextscan/"
        },
        {
          "name": "VulnCheck Advisory: NextScan 1.1.0 through 1.2.0 Stored XSS via URL Asset Detail View",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-stored-xss-via-url-asset-detail-view"
        }
      ],
      "title": "NextScan 1.1.0 through 1.2.0 Stored XSS via URL Asset Detail View",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126798",
    "datePublished": "2026-11-11T20:53:03.298Z",
    "dateReserved": "2026-11-11T20:01:47.109Z",
    "dateUpdated": "2026-11-13T17:45:51.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126797 (GCVE-0-2026-126797)

Vulnerability from cvelistv5 – Published: 2026-11-11 20:53 – Updated: 2026-11-11 20:53

Title

NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin

Summary

NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-321 - Use of Hard-coded Cryptographic Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8174 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/tongcheng-security-team/NextSc…	issue-tracking
https://github.com/tongcheng-security-team/NextSc…	product
https://hub.docker.com/r/lysec/ns-admin	product
https://vul.yulun.ac.cn/20261107/nextscan/	third-party-advisory
https://www.vulncheck.com/advisories/nextscan-1.1…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
tongcheng-security-team	NextScan	Affected: 1.1.0 , ≤ 1.2.0 (semver)

Date Public

2026-11-07 02:20

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:docker/lysec/ns-admin",
          "product": "NextScan",
          "vendor": "tongcheng-security-team",
          "versions": [
            {
              "lessThanOrEqual": "1.2.0",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-07T02:20:53.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "Use of Hard-coded Cryptographic Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T20:53:02.665Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/tongcheng-security-team/NextScan/issues/48"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/tongcheng-security-team/NextScan/blob/v1.2.0/docker/docker-compose.yaml"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://hub.docker.com/r/lysec/ns-admin"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261107/nextscan/"
        },
        {
          "name": "VulnCheck Advisory: NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-jwt-key-authentication-bypass-in-ns-admin"
        }
      ],
      "title": "NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126797",
    "datePublished": "2026-11-11T20:53:02.665Z",
    "dateReserved": "2026-11-11T20:01:46.748Z",
    "dateUpdated": "2026-11-11T20:53:02.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities found for NextScan by tongcheng-security-team

CVE-2026-126802 (GCVE-0-2026-126802)

CVE-2026-126798 (GCVE-0-2026-126798)

CVE-2026-126797 (GCVE-0-2026-126797)

CVE-2026-126802 (GCVE-0-2026-126802)

CVE-2026-126798 (GCVE-0-2026-126798)

CVE-2026-126797 (GCVE-0-2026-126797)