Stored Cross-Site Scripting Flaw in Admidio by Admidio

CVE-2026-109328

What is CVE-2026-109328?

Admidio versions prior to 5.0.15 contain a stored cross-site scripting vulnerability that allows attackers to inject harmful scripts via the user registration process. Specifically, the flaw resides in the RegistrationPresenter.php file, where the FIRST_NAME registration input is improperly handled. This lack of encoding enables attackers to utilize event handlers that execute malicious JavaScript when an administrator interacts with the affected entry in the Manage registrations interface. Effective remediation involves ensuring proper validation and sanitization of user inputs to mitigate potential exploitation.

References