Cross-site scripting vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If an attacking administrator configures the affected product with some malicious input, an arbitrary script may be executed on the web browser of a victim administrator who accesses the setting screen.

Cross-site scripting vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If an attacking administrator configures the affected product with some malicious input, an arbitrary script may be executed on the web browser of a victim administrator who accesses the setting screen.

Network Cameras TRIFORA 3 series provided by TOA Corporation contain multiple vulnerabilities listed below.<ul><li>OS command injection (CWE-78) - CVE-2026-20759</li><li>Cross-site scripting (CWE-79) - CVE-2026-20894</li><li>Path traversal (CWE-22) - CVE-2026-22876</li></ul>Shogo Iyota of GMO Cybersecurity by Ierae reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.