CVE-2026-7371

· HIGHAnalyzed

← All CVEs

CVSS v3.1

7.4

EPSS

0.21%

Published

May 3, 2026

Modified

May 4, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted malicious url can lead to an arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability. Reflected XXS via the error message for requesting non-existing page.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-79

Affected Products (4)

geovision · gv-lpc2011_firmwarevulnerable

geovision · gv-lpc2011

geovision · gv-lpc2211_firmwarevulnerable

geovision · gv-lpc2211

References (2)

https://talosintelligence.com/vulnerability_reports/

Third Party Advisory

https://www.geovision.com.tw/cyber_security.php

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs