The vulnerability resides in the eCard send handler of Admidio. Instead of using the sanitized value from the form, the code uses the raw $_POST['ecard_message'] when composing the greeting card HTML. Consequently, an authenticated user can inject arbitrary HTML and JavaScript into a greeting card email. This bypasses the server‑side HTMLPurifier sanitization, allowing phishing content that appears legitimate to be sent to other members. The flaw could lead to credential theft or malware installation if victims interact with the injected content.

Admidio, the open‑source user management solution. All installations of version 5.0.6 and earlier are vulnerable. The issue is resolved in version 5.0.7. The CNA identified the affected vendor/product as Admidio:admidio.

The CVSS base score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is not present in the KEV list. An attacker must be authenticated and have permission to send eCards. The attack path involves submitting a crafted eCard message that contains malicious HTML or script; the message is then delivered via email to the recipient’s client where the content is rendered. The impact is primarily phishing and potential credential compromise. Given the moderate score and low exploitation likelihood, the risk can be considered moderate but with the possibility of targeted attacks against active Admidio deployments.