CVE-2026-124506 · Package
NO FIX YET
Dianping CAT, a Java application monitoring platform, has a cross-site scripting flaw in its hourly report page where the domain argument is not sanitized. An attacker who gets a victim to open a crafted link can run script in the victim's browser session.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run Dianping CAT 3.0.0, 3.1.0 or 4.0-RC1 as a monitoring server with the Report Handler exposed to users. The flaw sits in the hourly report template, so a deployment where that page is unreachable or only reachable by trusted staff carries less risk. The sources do not describe a fixed release or a vendor response.
Not affected if other-versions, report-page-not-exposed
Who cares dianping-cat, java, self-hosted
3.0.0, 3.1.0 and 4.0-RC1.No fix yet, per the sources.
A vulnerability has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This vulnerability affects the function Model.getDomain of the file WEB-INF/tags/hourlyReport.tag of the component Report Handler. The manipulation of the argument domain leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.