Netcore NR255-V 1.5.130703 stored XSS via DHCP and ARP hostname fields

🕵️ RESEARCH & DEEP DIVES

• Netcore NR255-V 1.5.130703 stored XSS via DHCP and ARP hostname fields (CVE-2026-76873)
  Netcore NR255-V router firmware 1.5.130703 has a stored cross-site scripting vulnerability in its handling of DHCP and ARP hostname fields.

  • Affects Netcore NR255-V routers running firmware version 1.5.130703.
  • Stored cross-site scripting exists in the DHCP dynamic IP display and ARP bind list display components when handling hostname fields (CWE-79).
  • A LAN-based attacker injects malicious script via these hostname fields.
  • Injected script is later rendered by network_config.js and network_security.js in the web management interface.
  • CVE-2026-76873 scored 5.1 (CVSS v4.0) / 5.2 (CVSS v3.1), published 2026-09-15 with VulnCheck as assigner.
  Sources 📄 Source: github.com · 📎 Coverage: vulncheck.com · 👁 via CVE ThreatInt

• AWS STS simplifies session token limits to 4,096 bytes and adds token size monitoring
  AWS Security Token Service has replaced multiple session token size limits with a single 4,096-byte limit and now reports token size via API responses, CloudWatch, and CloudTrail.

  • Applies to AWS STS users calling session-vending APIs such as AssumeRole, AssumeRoleWithSAML, AssumeRoleWithWebIdentity, GetSessionToken, and GetFederationToken
  • The previously separate packed policy size and overall session token size limits are replaced with a single token size limit of 4,096 bytes, leaving more room for session policies and session tags
  • Session token size is now reported in STS API responses, Amazon CloudWatch metrics, and AWS CloudTrail events
  • STS can generate session tokens of different sizes so customers can test the maximum size their infrastructure supports; AWS may raise the 4,096-byte maximum in the future
  Sources 📎 Coverage: aws.amazon.com · 👁 via AWS Security Blog

• Joomla 6.1 finally lets admins force MFA on Super Users; 71% of sites still can't
  Joomla 6.1 fixed a restriction that previously made it impossible to require MFA for Super Users, and only 3.8% of monitored sites now enforce it.

  • Applies to Joomla administrators and agencies managing Joomla sites, especially those running Super User accounts
  • From Joomla 4.2.0 through 6.0.4, the forceMFAUserGroups field filtered out any group with core.admin, so the Super Users group never appeared in the dropdown and MFA could not be forced on it
  • PR #46248, merged 9 January 2026, removed the checksuperusergroup attribute; the fix shipped in Joomla 6.1.0 on 14 April 2026
  • The restriction was only in the configuration form — enforcement code always worked on Super Users once the group could be selected
  • Only 3.8% of Joomla sites on 6.1+ enforce MFA for Super Users, and 71% of monitored sites run versions where the setting is still unreachable
  Sources 📎 Coverage: mysites.guru · 👁 via mysites.guru (discovered)

🕵️ RESEARCH & DEEP DIVES

• Acronis warns of actively exploited flaw in its cPanel backup plugin — BleepingComputer

• Oracle September 2026 Critical Security Patch Update addresses 672 CVEs — Tenable Cyber Exposure

• Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Manageme... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Managemen... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Hand... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 Out-of-Bounds Read in mtd_write Firmware Upload Va... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in reboot_timer_set.cg... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 NULL Pointer Dereference in route_policy_add.cgi v... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Route/NAT Configura... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Pa... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 NULL Pointer Dereference via Unchecked atoi() in Q... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump ... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools_tcpdump_star... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in wake_up_set.cgi via... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_sho... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddn... — CVE ThreatInt

• Netcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_... — CVE ThreatInt

• Cotonti 1.0.0 Comments Plugin Critical PHP Object Injection (CVE-2026-91939) — thehackerwire.com (discovered)

• CVE-2026-87223: Vulnerability in the Oracle Hyperion Financial Management... — thehackerwire.com (discovered)