FastAdmin User Controller User.php login cross site scripting

published 2026-09-07 2 mo ago modified 2026-09-28 41 d ago also EUVD-2026-72191

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits: 0; none known

A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 1.2.1.20210731_beta is able to address this issue. The name of the patch is b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b. It is recommended to upgrade the affected component.

Patch / fix

fixed in 1 links 1

n/a FastAdmin 1.2.1.20210731_beta

github.com/fastadminnet/fastadmin@b3d32e2 commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 2 mo ago (2026-09-08)

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

lhzzz08.github.io https://lhzzz08.github.io/posts/cveapplication4/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
CNA	3.0	4.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
CNA	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C
CNA	4.0	2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CNA	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

n/a FastAdmin

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation
CWE-94 Improper Control of Generation of Code

References

github.com /fastadminnet/fastadmin/commit/b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b
patch
lhzzz08.github.io /posts/cveapplication4/
exploit
vuldb.com /vuln/399399
vdb-entry, technical-description
vuldb.com /vuln/399399/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-86244
third-party-advisory
vuldb.com /submit/898809
third-party-advisory

Sources

CVE List CVE-2026-86244
NVD CVE-2026-86244

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary