iremnurylmz/cve-2026-30695Proof-of-concept for CVE-2026-30695, an authenticated XSS in Zucchetti Axess access control devices via the dirBrowse parameter, enabling session hijacking and configuration changes.
A Cross-Site Scripting (XSS) vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices (XA4, X3/X3BIO, X4, X7, XIO, i-door, i-door+).
The vulnerability is caused by improper sanitization of user-supplied input in the dirBrowse parameter of the /file_manager.cgi endpoint. An authenticated attacker can inject arbitrary JavaScript code that is executed in the context of an administrative user.
Successful exploitation may lead to session hijacking, unauthorized configuration changes, and disclosure of sensitive information.
GET /file_manager.cgi?dirBrowse=PAYLOAD
Basic Example payload:
">
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
İremnur Yılmaz