CVE-2026-86244

FastAdmin User Controller User.php login cross site scripting

View on CVE.org
Published Sep 7, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 1.2.1.20210731_beta is able to address this issue. The name of the patch is b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b. It is recommended to upgrade the affected component.

Analysis

AI-generated

Technical impact

A flaw in FastAdmin’s User controller login function allows an attacker to inject arbitrary JavaScript into the url parameter. The script is reflected in the response and is executed in the victim’s browser, potentially exposing cookies, session identifiers, or enabling further phishing attacks. The vulnerability is a reflected XSS flaw, identified as CWE-79, and also allows untrusted input to be potentially embedded in executable code, classified as CWE-94.

Affected Systems

The issue affects FastAdmin releases up through 1.2.0.20210401_beta. Users operating any of these versions are vulnerable until they upgrade to 1.2.1.20210731_beta, which contains the patch commit b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b.

Risk and Exploitability

The CVSS base score is 5.3, placing the vulnerability in the moderate range, and the EPSS score is not available. The exploit is remote, relying on a crafted URL that can be generated without special privileges. While the impact is limited to client-side script execution, XSS can lead to session hijacking or credential theft in certain contexts.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade FastAdmin to version 1.2.1.20210731_beta, which includes the patch commit b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b.
  • If an upgrade cannot be performed immediately, disable or restrict access to the register/login endpoint or enforce strict input validation on the url field to reject JavaScript payloads.
  • Implement monitoring of web traffic for anomalous XSS attempts and consider adding a web application firewall rule to block reflected script injection.

Generated by OpenCVE AI on September 7, 2026 at 02:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 1.2.1.20210731_beta is able to address this issue. The name of the patch is b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b. It is recommended to upgrade the affected component.
Title FastAdmin User Controller User.php login cross site scripting
First Time appeared Fastadmin
Fastadmin fastadmin
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:fastadmin:fastadmin:*:*:*:*:*:*:*:*
Vendors & Products Fastadmin
Fastadmin fastadmin
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 8, 2026, 5:36 PM
Reserved
Sep 6, 2026, 9:35 AM

View source JSON

Updated
Sep 8, 2026, 5:36 PM

JSON

Status
Deferred
Published
Sep 7, 2026, 2:17 AM
Modified
Sep 28, 2026, 11:10 PM

View source JSON

No data.

Updated
Sep 7, 2026, 7:45 AM

JSON