EUVD-2026-17773
GHSA-4c6f-f3m2-g3pw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A security flaw has been discovered in z-9527 admin 1.0/2.0. Affected is an unknown function of the file /server/routes/message.js of the component Message Create Endpoint. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stored cross-site scripting (XSS) in z-9527 admin 1.0 and 2.0 allows authenticated remote attackers to inject malicious scripts via the Message Create Endpoint (/server/routes/message.js), affecting message content with user interaction required. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, leaving affected installations without an official patch.
Technical ContextAI
The vulnerability stems from inadequate input validation and output encoding in the message creation functionality of z-9527 admin. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied data in message creation is not properly sanitized before being rendered in the web application, allowing an authenticated user to craft malicious payloads. The affected component is the message.js route handler, which processes message creation requests without sufficient XSS protections. The attack vector is network-based, targeting the admin application's web interface where messages are created and subsequently displayed to other users.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to disclosure attempts. Immediate mitigations include: (1) restrict admin interface access to trusted networks via firewall rules; (2) implement Content Security Policy (CSP) headers to mitigate XSS payload execution; (3) disable or restrict the message creation feature if operationally feasible; (4) monitor admin logs for suspicious message creation activity containing script tags or encoded payloads. Organizations should track z-9527 project repositories and vendor communications for security updates. Patching or upgrading to a patched version should be prioritized if the vendor releases a fix.
A vulnerability classified as critical was found in ContiNew Admin 3.2.0. Rated medium severity (CVSS 5.1), this vulnera
Cross-site request forgery (CSRF) vulnerability in the Admin:hover module for Drupal allows remote attackers to hijack t
Privilege escalation in z-9527 admin 1.0/2.0 allows authenticated users to manipulate the isAdmin parameter in the User
Path traversal in z-9527 admin's file upload function allows authenticated remote attackers to manipulate the fileType p
The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary num
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today