{"id":"CVE-2026-124506","kind":"vulnerability","aliases":["CVE-2026-124506"],"related":[],"title":"Dianping CAT: report handler lets a crafted domain run scripts in browsers","description":"A vulnerability has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This vulnerability affects the function Model.getDomain of the file WEB-INF/tags/hourlyReport.tag of the component Report Handler. The manipulation of the argument domain leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Dianping CAT, a Java application monitoring platform, has a cross-site scripting flaw in its hourly report page where the domain argument is not sanitized. An attacker who gets a victim to open a crafted link can run script in the victim's browser session.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dianping-cat","java","package","self-hosted"],"not_affected_if":["other-versions","report-page-not-exposed"],"how_to_check":"- Check whether the Dianping CAT server is running, for example by looking for the CAT report pages under the web application.\n- Confirm the installed version: the affected versions are `3.0.0`, `3.1.0` and `4.0-RC1`.","fix":null,"status":"open","published_at":"2026-11-09T01:17:02+00:00","first_seen_at":"2026-11-09T01:23:57+00:00","triaged_at":"2026-11-09T01:25:33+00:00","updated_at":"2026-11-09T01:25:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T01:25:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Dianping CAT: report handler lets a crafted domain run scripts in browsers","impact":"medium","summary":"Dianping CAT, a Java application monitoring platform, has a cross-site scripting flaw in its hourly report page where the domain argument is not sanitized. An attacker who gets a victim to open a crafted link can run script in the victim's browser session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["dianping-cat","java","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in a logged-in monitoring user's browser session","analyst_note":"No fixed version or vendor response in sources; check the NVD entry and the upstream Dianping CAT repository for a patch or workaround.","how_to_check":"- Check whether the Dianping CAT server is running, for example by looking for the CAT report pages under the web application.\n- Confirm the installed version: the affected versions are `3.0.0`, `3.1.0` and `4.0-RC1`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions","report-page-not-exposed"],"who_is_affected":"Teams that run Dianping CAT 3.0.0, 3.1.0 or 4.0-RC1 as a monitoring server with the Report Handler exposed to users. The flaw sits in the hourly report template, so a deployment where that page is unreachable or only reachable by trusted staff carries less risk. The sources do not describe a fixed release or a vendor response.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000757,"input_tokens":4617,"output_tokens":590,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124506':15A,18A '-2026':14A,17A '/3.1.0/4.0-rc1':82C '/tags/hourlyreport.tag':95C '3.0.0':81C 'affect':85C 'applic':31B 'argument':49B,105C 'attack':54B,118C 'browser':12A,71B 'cat':2A,21B,28B,80C 'compon':98C 'contact':135C 'craft':7A,62B 'cross':37B,109C 'cross-sit':36B 'cve':13A,16A 'dianp':1A,20B,27B,79C 'dianping-cat':19B 'disclos':124C 'disclosur':139C 'domain':8A,48B,106C 'earli':136C 'exploit':121C 'file':91C 'flaw':40B 'found':77C 'function':87C 'get':56B 'handler':4A,100C 'host':26B 'hour':43B 'inf':94C 'initi':116C 'java':22B,30B 'lead':107C 'let':5A 'link':63B 'manipul':102C 'may':129C 'model.getdomain':88C 'monitor':32B 'open':60B 'packag':23B 'page':45B 'platform':33B 'possibl':114C 'public':127C 'remot':119C 'report':3A,44B,99C 'respond':143C 'run':9A,65B 'sanit':52B 'script':10A,39B,66B,111C 'self':25B 'self-host':24B 'session':72B 'site':38B,110C 'use':131C 'vendor':133C 'victim':58B,69B 'vulner':74C,84C 'way':146C 'web':93C 'web-inf':92C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Dianping CAT 3.0.0, 3.1.0 or 4.0-RC1 as a monitoring server with the Report Handler exposed to users. The flaw sits in the hourly report template, so a deployment where that page is unreachable or only reachable by trusted staff carries less risk. The sources do not describe a fixed release or a vendor response.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dianpingcat","java","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-124506':15A,18A '-2026':14A,17A 'browser':12A 'cat':2A 'craft':7A 'cve':13A,16A 'dianp':1A 'domain':8A 'handler':4A 'let':5A 'report':3A 'run':9A 'script':10A","search_b":"'applic':31B 'argument':49B 'attack':54B 'browser':71B 'cat':21B,28B 'craft':62B 'cross':37B 'cross-sit':36B 'dianp':20B,27B 'dianping-cat':19B 'domain':48B 'flaw':40B 'get':56B 'host':26B 'hour':43B 'java':22B,30B 'link':63B 'monitor':32B 'open':60B 'packag':23B 'page':45B 'platform':33B 'report':44B 'run':65B 'sanit':52B 'script':39B,66B 'self':25B 'self-host':24B 'session':72B 'site':38B 'victim':58B,69B","search_c":"'/3.1.0/4.0-rc1':82C '/tags/hourlyreport.tag':95C '3.0.0':81C 'affect':85C 'argument':105C 'attack':118C 'cat':80C 'compon':98C 'contact':135C 'cross':109C 'dianp':79C 'disclos':124C 'disclosur':139C 'domain':106C 'earli':136C 'exploit':121C 'file':91C 'found':77C 'function':87C 'handler':100C 'inf':94C 'initi':116C 'lead':107C 'manipul':102C 'may':129C 'model.getdomain':88C 'possibl':114C 'public':127C 'remot':119C 'report':99C 'respond':143C 'script':111C 'site':110C 'use':131C 'vendor':133C 'vulner':74C,84C 'way':146C 'web':93C 'web-inf':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T01:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124506","severity":null,"published_at":"2026-11-09T01:17:02+00:00","modified_at":"2026-11-09T01:17:02+00:00","first_seen_at":"2026-11-09T01:23:57+00:00","fetched_at":"2026-11-09T01:23:57+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}