ELADMIN CVE-2026-106701

Exploitation requires injecting script into the ELADMIN components named in the description - WebSocketServer, SpringSecurityConfig, or the deploy.vue server-deployment management view - and then a victim (typically an administrator, since these screens live inside the authenticated admin console) must load the page containing the payload (UI:R). Limiting factors: success depends on reaching those admin-area components, which in ELADMIN normally sit behind login, so despite the vector's PR:N the practical prerequisite may be an authenticated or attacker-controlled account; additionally the payload only fires on victim interaction and impact is confined to the browser session (no server-side code execution). Confirm with the vendor whether the affected input is reachable pre-authentication.

This is a moderate-severity stored/reflected Cross-Site Scripting flaw (CVSS 6.1) in the ELADMIN open-source Spring Boot + Vue admin framework. The provided CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) describes a network-reachable, low-complexity issue with no privileges required but mandatory user interaction and a scope change - the classic XSS profile where the attacker's code executes in a victim's authenticated browser session rather than in the vulnerable server itself. Real-world risk is tempered by several signals: no EPSS score was supplied, the CVE is NOT on the CISA KEV list (no confirmed active exploitation), and no public exploit was confirmed in the input (the linked CVE-Request markdown may contain reproduction detail, but POC availability is not established from the data provided). The impact is bounded - confidentiality and integrity are Low with no availability impact - meaning session hijacking or admin-action forgery is the realistic ceiling, not system compromise. One conflict to verify: the vector asserts PR:N (unauthenticated), yet the affected components (WebSocketServer, SpringSecurityConfig, deploy.vue - a server-deployment management screen) sit behind ELADMIN's authenticated admin console, which suggests reaching the injection point may in practice require a valid session (PR:L); verify whether the XSS is reflected/pre-auth or stored/post-auth with the vendor. Net: a legitimate but not top-priority issue - a Medium XSS in a niche admin tool with no confirmed exploitation, worth patching but not an emergency.

An attacker injects a malicious script payload into an input processed by ELADMIN's deployment/WebSocket handling; when an administrator later views the affected page in the admin console, the script executes in their authenticated session, allowing session-cookie theft or actions performed as the admin. Because user interaction is required (UI:R) and the scope changes (S:C), the payload runs against a different security context (the victim's browser) than the one it was stored in. No public exploit code was confirmed in the provided data, though a CVE-Request reference exists.