CVE-2026-32843 is a reflected cross-site scripting vulnerability in the Location Aware Sensor System (LASS) by LinkItONEDevGroup. The flaw exists in the PM25.php file where user-supplied GET parameters (site, city, district, channel, apikey) are not properly sanitized or encoded before being included in the web page output. This allows an attacker to craft malicious URLs that execute arbitrary JavaScript in the context of the victim's browser upon visiting the page. The vulnerability affects versions up to commit f06bd20 (2023-04-26). No official patch or fix is currently referenced.

Successful exploitation enables remote attackers to execute arbitrary JavaScript code in the browsers of users who visit a maliciously crafted URL. This can lead to session hijacking, defacement, or other client-side attacks. The vulnerability does not require authentication and has a network attack vector with low attack complexity. User interaction is required (visiting the malicious URL). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on suspicious or untrusted URLs containing the affected parameters. Developers should implement proper input validation and output encoding on the PM25.php page to neutralize malicious input. Monitor vendor channels for updates or patches addressing this vulnerability.