CVE-2026-41661

CVE-2026-41661 describes a reflected XSS in Admidio prior to 5.0.9. The attack uses the endpoint system/msg_window.php; input in message_var1 is passed through htmlspecialchars(), which leaves square brackets intact. Language::prepareTextPlaceholders() then converts [ and ] to , allowing the inje...