Description
A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 1.2.1.20210731_beta is able to address this issue. The name of the patch is b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b. It is recommended to upgrade the affected component.
Published: 2026-09-07
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross-Site Scripting via manipulated URL parameter
Action: Apply Patch
AI Analysis

Impact

A flaw in FastAdmin’s User controller login function allows an attacker to inject arbitrary JavaScript into the url parameter. The script is reflected in the response and is executed in the victim’s browser, potentially exposing cookies, session identifiers, or enabling further phishing attacks. The vulnerability is a reflected XSS flaw, identified as CWE-79, and also allows untrusted input to be potentially embedded in executable code, classified as CWE-94.

Affected Systems

The issue affects FastAdmin releases up through 1.2.0.20210401_beta. Users operating any of these versions are vulnerable until they upgrade to 1.2.1.20210731_beta, which contains the patch commit b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b.

Risk and Exploitability

The CVSS base score is 5.3, placing the vulnerability in the moderate range, and the EPSS score is not available. The exploit is remote, relying on a crafted URL that can be generated without special privileges. While the impact is limited to client-side script execution, XSS can lead to session hijacking or credential theft in certain contexts.

Generated by OpenCVE AI on September 7, 2026 at 02:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FastAdmin to version 1.2.1.20210731_beta, which includes the patch commit b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b.
  • If an upgrade cannot be performed immediately, disable or restrict access to the register/login endpoint or enforce strict input validation on the url field to reject JavaScript payloads.
  • Implement monitoring of web traffic for anomalous XSS attempts and consider adding a web application firewall rule to block reflected script injection.

Generated by OpenCVE AI on September 7, 2026 at 02:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 1.2.1.20210731_beta is able to address this issue. The name of the patch is b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b. It is recommended to upgrade the affected component.
Title FastAdmin User Controller User.php login cross site scripting
First Time appeared Fastadmin
Fastadmin fastadmin
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:fastadmin:fastadmin:*:*:*:*:*:*:*:*
Vendors & Products Fastadmin
Fastadmin fastadmin
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Fastadmin Fastadmin
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-08T17:36:27.734Z

Reserved: 2026-09-06T09:35:07.004Z

Link: CVE-2026-86244

cve-icon Vulnrichment

Updated: 2026-09-08T17:36:24.280Z

cve-icon NVD

Status : Deferred

Published: 2026-09-07T02:17:21.247

Modified: 2026-09-08T18:21:16.913

Link: CVE-2026-86244

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T07:45:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')