CVE-2026-109328
6.1MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser session to steal credentials or modify data. The attacker needs to submit a malicious registration and have an admin hover over the entry on the Manage registrations page.
Root cause
RegistrationPresenter.php inserts the unencoded FIRST_NAME input directly into a data-message HTML attribute, enabling attribute injection and stored cross-site scripting.
Affected systems
Admidio 5.0.0 before 5.0.15
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade Admidio to version 5.0.15 or later. If patching immediately is not possible, disable public registration or restrict access to the Manage registrations administrative page.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRST_NAME registration value into an unencoded data-message attribute. Attackers can register with a double-quoted event handler that executes JavaScript in an administrator's session when they hover the entry on the Manage registrations page.