CVE-2026-51133: C-MOR Video Surveillance Reflected XSS with PoC and Mitigations

CVE-2026-51133 Key Information Summary Vulnerability Overview Vulnerability Name: CVE-2026-51133: Cross-Site Scripting (XSS) vulnerability in C-MOR Video Surveillance system Vulnerability Type: Reflected Cross-Site Scripting (Reflected XSS, CWE-79) Affected Product: C-MOR Video Surveillance (developed by za-internet GmbH) Affected Versions: Up to and including V6.0104 Affected Components: (parameter ) and Discoverer: Samir Shamdin, Alb Cyber Guards Verification Date: July 23, 2026 Impact Scope This vulnerability allows an attacker to execute arbitrary JavaScript code in the browser of a logged-in user by crafting a malicious URL. The attacker must induce an authenticated user to click on a specially crafted link, thereby executing the script within the user's session context. Exploitable scenarios include: - Session Hijacking: The attacker can read and manipulate the Cookies and session data of an authenticated user. - Video Stream Access: The attacker can access live video streams, replays, and camera configurations. - UI Tampering: The attacker can modify interface elements to carry out phishing attacks. - Network Sniffing: Since video surveillance systems are often deployed within network segments, sensitive systems can be sniffed. Remediation Measures 1. Version Check: All installed versions up to V6.0104 are affected; please check the current version in the web interface. 2. Patch Update: Contact the vendor to obtain the fixed version and deploy it as soon as possible. 3. Access Restriction: Video surveillance systems should not be directly exposed to the public internet; it is recommended to access them via VPN or a dedicated network. 4. Network Segmentation: Place cameras and surveillance systems in an independent VLAN and prohibit direct access via external links. 5. Principle of Least Privilege for Administrators: Do not share system links via email or chat; addresses should be typed manually. POC Code Variant 1: XSS via HTML Attribute Variant 2: XSS in JavaScript Context Related Vulnerabilities CVE-2026-51134: Path Traversal vulnerability in C-MOR Video Surveillance system (discovered in parallel)

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-51133: C-MOR Video Surveillance Reflected XSS with PoC and Mitigations

More from this source