Is there a public PoC exploit available for EUVD-2026-18225?

Yes, a public proof-of-concept exploit is available for EUVD-2026-18225. Prioritise patching immediately. EPSS: 0.0%.

PHP EUVD-2026-18225

Q: What is the CVSS score of EUVD-2026-18225?

EUVD-2026-18225 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5332 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-02 VulDB

GHSA-hmp9-q24j-h3f5

PHP XSS Panel

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 07, 2026 - 18:50 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 13:45 euvd

EUVD-2026-18225

Analysis Generated

Apr 02, 2026 - 13:45 vuln.today

CVE Published

Apr 02, 2026 - 13:15 nvd

MEDIUM 5.1

DescriptionCVE.org

A vulnerability was identified in Xiaopi Panel 1.0.0. This vulnerability affects unknown code of the file /demo.php of the component WAF Firewall. The manipulation of the argument param leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stored cross-site scripting (XSS) in Xiaopi Panel 1.0.0 via the param argument in /demo.php allows authenticated remote attackers to inject malicious scripts that execute in users' browsers. The vulnerability affects the WAF Firewall component, has publicly available exploit code, and carries a low CVSS score (3.5) due to requirement for user interaction and limited impact scope, though the vendor has not responded to disclosure.

Technical ContextAI

The vulnerability stems from improper input validation on the param argument passed to /demo.php in Xiaopi Panel's WAF Firewall component. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic web application flaw where user-supplied data is reflected or stored in HTML output without sanitization or encoding. The PHP backend fails to sanitize or HTML-encode the param parameter before rendering it in the response, allowing attackers to inject arbitrary HTML and JavaScript. This is a reflected or stored XSS vulnerability depending on whether the param value is persisted or merely echoed back in the response.

RemediationAI

No vendor-released patch identified at time of analysis. The vendor was contacted early but provided no response, indicating limited likelihood of an official fix in the near term. Immediate workarounds include: (1) Restrict access to /demo.php and the WAF Firewall component via network segmentation or authentication controls; (2) Implement strict input validation and HTML entity encoding on the param argument; (3) Deploy Content Security Policy (CSP) headers to mitigate reflected XSS execution; (4) Monitor access logs for suspicious param values containing script tags or event handlers. Organizations unable to patch should consider alternative WAF or panel solutions from vendors with active security response. Reference: https://vuldb.com/vuln/354666 and https://github.com/ltranquility/vuln_submit/issues/1 for additional technical details.