4.3
Medium
CVE-2026-66247 iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a…
Description
iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active session.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| iControl | 4.5.0 | No fix stated |
Other CVEs of iControl
The 6 CVEs of iControl →
CVE-2026-66253
iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or…
3.1
Low
CVE-2026-66249
iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies…
3.1
Low
CVE-2026-66248
iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to…
3.1
Low
CVE-2026-66246
iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing…
8.8
High