Admidio versions 4.0.12 through 4.3.17 and 5.0.0 through 5.0.14 contain an incomplete fix for a previous XSS flaw. The flaw allows an unauthenticated attacker to supply a crafted javascript: URL in the url parameter of system/redirect.php, bypassing the existing validation due to a decoy http:// segment. When a user follows that link, the browser executes the embedded JavaScript in the context of the Admidio origin. The vulnerability is client‑side and does not provide direct code execution or privilege escalation.

Admidio installations running any of the following versions are affected: Admidio 4.0.12 up to and including 4.3.17, and Admidio 5.0.0 up to and including 5.0.14. Any deployment that uses these releases is potentially vulnerable regardless of authentication status.

The CVSS score of 5.1 indicates moderate severity. No EPSS score is available, so the current exploitation probability is unspecified. The vulnerability is not listed in CISA's KEV catalog, meaning no widespread exploitation has been documented. The likely attack vector is a targeted phishing or social‑engineering scenario in which the attacker crafts a malicious redirect link and persuades a user to click it, causing the script to run in the victim's browser. This requires no interaction beyond the click and does not require privileged access to the application.