Stored Cross-Site Scripting in 1024-lab SmartAdmin v3.30.0
CVE-2026-88618

6.5MEDIUM

Key Information:

Vendor

1024-lab

Status
SmartAdmin
Vendor
CVE Published:
15 September 2026

What is CVE-2026-88618?

The SmartAdmin v3.30.0 from 1024-lab features a stored cross-site scripting vulnerability within its file upload functionality. This flaw enables a remote attacker to inject and execute arbitrary code, potentially compromising the security of the application and its users. Addressing this issue is crucial to prevent unauthorized actions and maintain the integrity of the system. For further details, refer to the project's repository and related security advisories.

References

https://github.com/1024-lab/smart-admin
https://github.com/returnwrong/returnwrong-security-advis...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.