Linkit One · Linkit One Location Aware Sensor System · CVE-2026-32843
**Name of the Vulnerable Software and Affected Versions**
Linkit ONE Location Aware Sensor System versions up to commit f06bd20 (2023-04-26)
**Description**
The Location Aware Sensor System by Linkit ONE is susceptible to a reflected cross-site scripting issue in the `PM25.php` file. This allows remote attackers to execute arbitrary JavaScript code by injecting malicious code into GET parameters. Specifically, attackers can craft a malicious URL containing unencoded payloads in the `site`, `city`, `district`, `channel`, or `apikey` parameters. When a user visits the crafted URL, scripts are executed in their browser.
**Recommendations**
Versions up to commit f06bd20 (2023-04-26) should be updated.