EUVD-2026-17773
GHSA-4c6f-f3m2-g3pw
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS score of 3.5 is low, several factors elevate practical risk: the attack requires authentication (PR:L per CVSS vector) and user interaction (UI:R), but publicly available exploit code exists, reducing barriers to abuse by insiders or compromised accounts. The CVSS Environmental metric (E:P) indicates proof-of-concept availability, consistent with the public GitHub repository. The 'unknown function' designation and vendor non-responsiveness mean no official remediation timeline exists. However, the low impact scope (S:U, no confidentiality loss, limited integrity impact) and requirement for user interaction limit this to a moderate concern for most deployments. Risk is elevated in multi-user admin environments where message functionality is actively used, but negligible in isolated or single-user installations. |
| Exploit ScenarioDerived | An authenticated admin user with access to the admin panel crafts a message containing a malicious JavaScript payload (e.g., <script>alert('XSS')</script>) through the Message Create Endpoint. Due to insufficient input sanitization, the payload is stored in the application database and executed in the browser of any other admin user who views or interacts with the message, potentially stealing session tokens, redirecting to phishing sites, or performing unauthorized actions on behalf of the victim. Public exploit code from the GitHub repository lowers the technical barrier for attackers with existing admin credentials or those who have compromised an admin account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
Stored cross-site scripting (XSS) in z-9527 admin 1.0 and 2.0 allows authenticated remote attackers to inject malicious scripts via the Message Create Endpoint (/server/routes/message.js), affecting message content with user interaction required. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, leaving affected installations without an official patch.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to disclosure attempts. Immediate mitigations include: (1) restrict admin interface access to trusted networks via firewall rules; (2) implement Content Security Policy (CSP) headers to mitigate XSS payload execution; (3) disable or restrict the message creation feature if operationally feasible; (4) monitor admin logs for suspicious message creation activity containing script tags or encoded payloads. Organizations should track z-9527 project repositories and vendor communications for security updates. Patching or upgrading to a patched version should be prioritized if the vendor releases a fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from inadequate input validation and output encoding in the message creation functionality of z-9527 admin. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied data in message creation is not properly sanitized before being rendered in the web application, allowing an authenticated user to craft malicious payloads. The affected component is the message.js route handler, which processes message creation requests without sufficient XSS protections. The attack vector is network-based, targeting the admin application's web interface where messages are created and subsequently displayed to other users.
Know when Admin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in z-9527 admin 1.0/2.0. Affected is an unknown function of the file /server/routes/message.js of the component Message Create Endpoint. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in z-9527 admin Multiple Vulnerabilities
View all 2A vulnerability classified as critical was found in ContiNew Admin 3.2.0. Rated medium severity (CVSS 5.1), this vulnera
Cross-site request forgery (CSRF) vulnerability in the Admin:hover module for Drupal allows remote attackers to hijack t
Path traversal in z-9527 admin's file upload function allows authenticated remote attackers to manipulate the fileType p
The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary num
Exploit-DB