CVE-2026-124506: Dianping CAT Report hourlyReport.tag Model.getDomain cross site scripting
A vulnerability has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This vulnerability affects the function Model.getDomain of the file WEB-INF/tags/hourlyReport.tag of the component Report Handler. The manipulation of the argument domain leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker can initiate the attack remotely by manipulating the domain argument handled by Model.getDomain in WEB-INF/tags/hourlyReport.tag. Successful exploitation requires user interaction, consistent with the reported UI:R vector.
Which releases are identified as affected?
The affected releases listed are Dianping CAT 3.0.0, 3.1.0, and 4.0-RC1. The issue is in the Report Handler component's hourlyReport.tag file.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
Is a vendor response or fix identified?
No vendor response is reported. The vendor was contacted early about the disclosure but did not respond.