C-MOR 6.0104 - Cross-Site Scripting (XSS)
Description
C-MOR Video Surveillance version 6.0104 and earlier contains a Cross-Site Scripting (XSS) vulnerability. The flaw exists due to improper input sanitization of the 'size' parameter in the ptzpreset.pml component and the 'anyparam' parameter in the show-movies.pml component. An attacker can craft malicious URLs that, when visited by an authenticated user, execute arbitrary JavaScript code within the context of the affected application. Proof-of-concept exploit URLs have been published. No vendor patch or advisory is currently available, and there is no evidence of active exploitation in the wild.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-51133 is a Cross-Site Scripting vulnerability affecting za-internet GmbH's C-MOR Video Surveillance software versions up to and including 6.0104. The vulnerability arises from insufficient input validation of the 'size' parameter in ptzpreset.pml and the 'anyparam' parameter in show-movies.pml components. Remote attackers can exploit this by enticing authenticated users to click crafted URLs that inject and execute arbitrary client-side scripts. Exploit code demonstrating this attack is publicly available. No official patch or vendor advisory has been released yet.
Potential Impact
Successful exploitation allows execution of arbitrary client-side code in the context of the vulnerable web application. This can lead to session hijacking, unauthorized actions performed on behalf of the user, and other client-side impacts. However, there is no current evidence of exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable components and implement web application firewall (WAF) rules to filter and block malicious input targeting the 'size' and 'anyparam' parameters.
Technical Details
- Cve
- CVE-2026-51133
- Version
- <= 6.0104
- Author
- Samir Shamdin
- Platform
- C-MOR Video Surveillance V6.0104
- Edb Id
- 52665
- Has Exploit Code
- true
- Code Language
- text
Indicators of Compromise
Exploit Source Code
Exploit code for C-MOR 6.0104 - Cross-Site Scripting (XSS)
# Exploit Title: C-MOR 6.0104 - Cross-Site Scripting (XSS) # Google Dork: N/A # Date: 2026-07-23 # Exploit Author: Samir Shamdin (Alb Cyber Guards) # Vendor Homepage: https://www.c-mor.com # Software Link: https://www.c-mor.com/ # Version: <= 6.0104 # Tested on: C-MOR Video Surveillance V6.0104 # CVE: CVE-2026-51133 # 1. Description: # A Cross-Site Scripting (XSS) vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 # allows a remote attacker to execute arbitrary client-side... (496 more characters)
Threat ID: 6a95bd28acd9273b49648ee0
Added to database: 08/31/2026, 17:43:04 UTC
Last enriched: 10/07/2026, 22:43:25 UTC
Last updated: 10/13/2026, 22:25:19 UTC
Views: 87
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.