Admidio’s system/msg_window.php fails to properly encode user input. The function htmlspecialchars() is used but it does not affect square brackets, which later Language::prepareTextPlaceholders() turns into angle brackets. As a result an attacker can embed arbitrary JavaScript that runs in the victim’s browser, enabling theft of credentials, session hijacking or defacement. The flaw is a client‑side injection (CWE‑79) that affects confidentiality and integrity of the application state.

Any deployment of the Admidio open‑source user management solution with a version older than 5.0.9 is vulnerable. The vulnerability was fixed in the 5.0.9 release; earlier releases remain at risk.

The CVSS score of 6.1 indicates moderate severity. Although no EPSS value is provided and the flaw is not listed in CISA’s KEV catalog, the remote, unauthenticated nature of the exploit means any user who can load the affected page could be compromised. Attackers would need only to craft a URL or form that triggers the payload. The impact is limited to the victim’s browser, not the server itself, but the attacker can still extract or alter data carried by the user.