Admidio CVE-2026-109328

Exploitation requires that Admidio's self-registration (event or site registration) is reachable by the attacker so a FIRST_NAME value can be submitted, and it only triggers when an administrator subsequently views the Manage registrations page and hovers over the attacker-controlled entry (UI:P passive interaction). The payload must be a double-quoted HTML event handler that breaks out of the unencoded data-message attribute. Limiting factors: execution depends entirely on an admin viewing and hovering the malicious row, so the payload lies dormant until privileged review; it is constrained to Admidio versions 5.0.0 through 5.0.14 (fixed in 5.0.15); and impact is confined to the administrator's browser session rather than the server.

This is a moderate-risk unauthenticated stored XSS (CWE-79) in Admidio's RegistrationPresenter.php. The only authoritative signal is the vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.3): network attack vector, low complexity, no attacker privileges, but passive user interaction required (an administrator must hover the malicious entry). Impact lands on a subsequent system (the admin's browser/session) with SC:L/SI:L and no direct impact to the Admidio server itself (VC/VI/VA = N), which is consistent with reflected-into-admin-session XSS rather than server compromise. No EPSS score, no CISA KEV listing, and no POC were provided in the intelligence, so exploitation status is: no public exploit identified at time of analysis. The combination of unauthenticated injection (anyone who can register) and a privileged victim (administrator) makes this more than a theoretical high-CVSS-but-low-risk issue, but the mandatory admin interaction and absence of any exploitation evidence keep it below critical. Note the CVSS 4.0 vector asserts no confidentiality/integrity impact to the vulnerable system but SC:L/SI:L to the subsequent system - defenders should treat the realistic worst case as admin-session hijack/action-on-behalf-of-admin via XSS, which can indirectly lead to fuller compromise even though the base metrics do not model that escalation.

An attacker self-registers for an event (or the site) supplying a FIRST_NAME value containing a double-quoted HTML event handler; Admidio stores it and later emits it unencoded into a data-message attribute on the Manage registrations page. When an administrator reviews pending registrations and hovers over the attacker's entry, the injected event handler fires and executes arbitrary JavaScript in the administrator's authenticated session. No public exploit code was identified in the provided data, though the technique is straightforward to reproduce from the description.