Uniview NVR301-04S2-P4 (Update A)
The affected product is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability affects both authenticated and unauthenticated pages under the /LAPI/ directory. As session data is unavailable, the scope is limited.