# CVE-2026-42366: Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of…

Source: https://junglewise.ai/threats/cve-2026-42366-multiple-reflected-cross-site-scripting-xss-vulnerabilities-exist  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04  
License: CC BY 4.0 with a link back

CVE-2026-42366 · Severity: high · CVSS 7.4 · Published 2026-05-04

Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted malicious url can lead to an arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.

Technologies: [Geovision Gv-Lpc2011](https://junglewise.ai/threats/technologies/gv-lpc2011), [Geovision Gv-Lpc2011 Firmware](https://junglewise.ai/threats/technologies/gv-lpc2011-firmware), [Geovision Gv-Lpc2211](https://junglewise.ai/threats/technologies/gv-lpc2211), [Geovision Gv-Lpc2211 Firmware](https://junglewise.ai/threats/technologies/gv-lpc2211-firmware). Vendors: [Geovision](https://junglewise.ai/threats/vendors/geovision).

## Quick answers

**Is CVE-2026-42366 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42366 being exploited in the wild.

**How severe is CVE-2026-42366?** High severity, with a CVSS score of 7.4, published 4 May 2026.

**Which products and versions are affected?** Geovision Gv-Lpc2011, Geovision Gv-Lpc2011 Firmware, Geovision Gv-Lpc2211, Geovision Gv-Lpc2211 Firmware. The advisory does not name versions.

**Is there a fix for CVE-2026-42366?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-42366?** Check whether you run Geovision Gv-Lpc2011, Geovision Gv-Lpc2011 Firmware, Geovision Gv-Lpc2211 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Geovision Gv-Lpc2011
- Geovision Gv-Lpc2011 Firmware
- Geovision Gv-Lpc2211
- Geovision Gv-Lpc2211 Firmware

## Related threats

- [GeoVision GV-LPC2211 unbounded frame length denial of service](https://junglewise.ai/threats/cve-2026-88290-geovision-gv-lpc2211-unbounded-frame-length-denial-of-service)
- [GeoVision GV-LPC2211 stack buffer overflow in VLSVR request handlers](https://junglewise.ai/threats/cve-2026-88289-geovision-gv-lpc2211-stack-buffer-overflow-in-vlsvr-request)
- [GeoVision GV-LPC2211 path traversal in BKDownloadLink.cgi](https://junglewise.ai/threats/cve-2026-88288-geovision-gv-lpc2211-path-traversal-in-bkdownloadlink-cgi)
- [GeoVision GV-LPC2211 stack overflow in ONVIF WS-Discovery](https://junglewise.ai/threats/cve-2026-88287-geovision-gv-lpc2211-stack-overflow-in-onvif-ws-discovery)
- [GeoVision GV-LPC2211 PTZ connection state denial of service](https://junglewise.ai/threats/cve-2026-88286-geovision-gv-lpc2211-ptz-connection-state-denial-of-service)