CVE-2026-0396— HTML injection in the web dashboard
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-0396
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HTML injection in the web dashboard
Source: NVD (National Vulnerability Database)
Vulnerability Description
An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
DNSdist 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
DNSdist是DNSdist开源的一款高度感知 DNS、DoS 和滥用的负载均衡器。 DNSdist存在安全漏洞，该漏洞源于攻击者可能通过向启用了基于域的动态规则的DNSdist实例发送特制DNS查询，将HTML内容注入内部Web仪表板。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-0396
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-0396
请登录查看更多情报信息。
Same Patch Batch · PowerDNS · 2026-03-31 · 7 CVEs total
| CVE-2026-24029 | 6.5 MEDIUM | DNS over HTTPS ACL bypass |
| CVE-2026-27853 | 5.9 MEDIUM | Out-of-bounds write when rewriting large DNS packets |
| CVE-2026-24030 | 5.3 MEDIUM | Unbounded memory allocation for DoQ and DoH3 |
| CVE-2026-24028 | 5.3 MEDIUM | Out-of-bounds read when parsing DNS packets via Lua |
| CVE-2026-27854 | 4.8 MEDIUM | Use after free when parsing EDNS options in Lua |
| CVE-2026-0397 | 3.1 LOW | Information disclosure via CORS misconfiguration |
IV. Related Vulnerabilities
V. Comments for CVE-2026-0396
No comments yet