https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T00:35:10.735336+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-71274 CVE-2026-71274 — OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels 2026-10-07T00:35:10.736655+00:00

Affected: openshwprojects OpenBK7231T_App

OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.