# CVE-2026-124506: Dianping CAT cross-site scripting in report handler

Source: https://junglewise.ai/threats/cve-2026-124506-a-vulnerability-has-been-found-in-dianping-cat-3-0-0-3-1-0-4-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-124506 · Severity: medium · CVSS 4.3 · Published 2026-11-09

Dianping CAT is a Java-based application performance monitoring tool used for tracking system metrics and generating reports. A cross-site scripting (XSS) vulnerability in the report generation component allows attackers to inject malicious scripts into reports, potentially compromising user sessions or stealing sensitive data when reports are viewed.

Technologies: [Dianping CAT](https://junglewise.ai/threats/technologies/cat). Vendors: [Dianping](https://junglewise.ai/threats/vendors/dianping).

## Quick answers

**Is CVE-2026-124506 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124506 being exploited in the wild.

**How severe is CVE-2026-124506?** Medium severity, with a CVSS score of 4.3, published 9 November 2026.

**Which products and versions are affected?** Dianping CAT 3.0.0, 3.1.0, 4.0-RC1.

**Is there a fix for CVE-2026-124506?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-124506 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-124506?** Check whether you run Dianping CAT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the Model.getDomain function within the WEB-INF/tags/hourlyReport.tag Report Handler component, where the domain argument is not properly sanitized before being reflected in output. This leads to a stored or reflected XSS condition that can be triggered remotely without authentication. An attacker can inject arbitrary JavaScript that executes in the victim's browser with the privileges of the logged-in user.

## Affected products

- Dianping CAT 3.0.0, 3.1.0, 4.0-RC1

## Timeline

- 2026-11-09: disclosed
- 2026-11-09: advisory

## References

- [https://vuldb.com/cve/CVE-2026-124506](https://vuldb.com/cve/CVE-2026-124506)
- [https://vuldb.com/submit/1035481](https://vuldb.com/submit/1035481)

## Related threats

- [Dianping CAT open redirect in login handler](https://junglewise.ai/threats/cve-2026-124505-a-flaw-has-been-found-in-dianping-cat-3-0-0-3-1-0-4-0-rc1-this)
- [Dianping CAT session cookie forgery via weak hash integrity check](https://junglewise.ai/threats/cve-2026-85181-dianping-cat-session-cookie-forgery-via-weak-hash-integrity-check)