Description
A vulnerability was identified in Xiaopi Panel 1.0.0. This vulnerability affects unknown code of the file /demo.php of the component WAF Firewall. The manipulation of the argument param leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-04-02
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting via unsanitized input in /demo.php
Action: Patch
AI Analysis

Impact

The flaw occurs in the /demo.php script of Xiaopi Panel 1.0.0 when the param argument is reflected without proper sanitization, allowing an attacker to inject arbitrary HTML or JavaScript. The injected code runs in the victim’s browser, which can enable credential theft, defacement, or the execution of other client‑side attacks. The vulnerability is a reflected XSS that is publicly documented and an exploit script is available.

Affected Systems

The affected product is Xiaopi Panel 1.0.0. All installations that expose the demo.php endpoint with the vulnerable param handling are impacted.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity, and the EPSS score is below 1 %, reflecting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Remote exploitation is possible by sending a crafted URL to a vulnerable host. Because the flaw is client‑side, it does not compromise the server directly, but it can lead to data theft or session hijacking when a user visits the affected page.

Generated by OpenCVE AI on April 7, 2026 at 23:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any official patch or firmware update released by Xiaopi for Panel 1.0.0; if none, request a fix.
  • If the demo.php endpoint is not required, remove or restrict access to it using web‑server configuration or firewall rules.
  • Implement additional input validation or use an application‑level WAF to block reflected XSS attacks.
  • Monitor web logs for suspicious query strings containing script payloads and enforce security best‑practice controls.

Generated by OpenCVE AI on April 7, 2026 at 23:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Apr 2026 20:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:xiaopi:panel:1.0.0:*:*:*:*:*:*:*

Fri, 03 Apr 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Xiaopi
Xiaopi panel
Vendors & Products Xiaopi
Xiaopi panel

Thu, 02 Apr 2026 13:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Xiaopi Panel 1.0.0. This vulnerability affects unknown code of the file /demo.php of the component WAF Firewall. The manipulation of the argument param leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Xiaopi Panel WAF Firewall demo.php cross site scripting
Weaknesses CWE-79
CWE-94
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Xiaopi Panel
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-03T19:52:05.065Z

Reserved: 2026-04-01T13:57:58.665Z

Link: CVE-2026-5332

cve-icon Vulnrichment

Updated: 2026-04-03T19:51:56.472Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-02T14:16:36.163

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-5332

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-08T19:56:35Z

Weaknesses