CVE-2026-55730: Loytec Lweb-802

High severity, CVSS 8.7. EPSS: 0.6% chance of exploitation in the next 30 days.

Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious `project` or `mspParams` parameter.

Affected products

• Loytec Lweb-802: before 5.0.8 (fixed in 5.0.8)

Published 2026-07-24. Last modified 2026-07-27.