CVE-2026-51133Medium· 6.1▾ TwilightPoC available

Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml component

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score46/ 100 · Moderate

impact 33.6 · likelihood 0.2 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Sep 15, 2026

Updated

Sep 22, 2026

CVSS

6.1

Vendor

—

Product

—

CWE

CWE-79

Depth score

46 · Moderate

EPSS

0.91% · p60

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-27

Exploit-DB: Search Exploit-DB for CVE-2026-51133 ↗

CISA SSVC

decided 2026-09-17

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Sep 17.

0.9% → 0.9%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

7 events · 43 days

Sep 15, 2026Published
Disclosed via NVD
Sep 17, 2026EPSS first tracked
0.9%
Sep 17, 2026CVSS changed
— → 6.1
Sep 17, 2026Severity changed
none → medium
Sep 22, 2026Record revised
Last analysed / modified upstream
Sep 25, 2026EPSS peak
0.9% → 0.9%
Oct 27, 2026Public exploit observed
Exploit-DB (last check)

CWE-79 #nvd #exploit-available #cve.org

Full technical detail▾

Overview

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Change history

Field changes observed since this record was first indexed.

Sep 17, 2026CVSS — → 6.1
Sep 17, 2026Severity none → medium

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available#cve.org

← Back to feed

CVE-2026-51133Medium· 6.1▾ TwilightPoC available

Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml component

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score46/ 100 · Moderate

impact 33.6 · likelihood 0.2 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Sep 15, 2026

Updated

Sep 22, 2026

CVSS

6.1

Vendor

—

Product

—

CWE

CWE-79

Depth score

46 · Moderate

EPSS

0.91% · p60

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-27

Exploit-DB: Search Exploit-DB for CVE-2026-51133 ↗

CISA SSVC

decided 2026-09-17

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Sep 17.

0.9% → 0.9%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

7 events · 43 days

Sep 15, 2026Published
Disclosed via NVD
Sep 17, 2026EPSS first tracked
0.9%
Sep 17, 2026CVSS changed
— → 6.1
Sep 17, 2026Severity changed
none → medium
Sep 22, 2026Record revised
Last analysed / modified upstream
Sep 25, 2026EPSS peak
0.9% → 0.9%
Oct 27, 2026Public exploit observed
Exploit-DB (last check)

CWE-79 #nvd #exploit-available #cve.org

Full technical detail▾

Overview

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Change history

Field changes observed since this record was first indexed.

Sep 17, 2026CVSS — → 6.1
Sep 17, 2026Severity none → medium

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available#cve.org