All vulnerabilities
CVE-2025-70519

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which ca

n/a n/a
Open in ThreatlineRecord JSON
CVSS
6.1Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 7 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published7 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component.

Text from CVE List

Affected versions 1

  • n/aaffected: n/aCVE List

References 2