CVE-2026-109328

Admidio versions 5.0.0 before 5.0.15 are vulnerable to an unauthenticated stored cross-site scripting (XSS) flaw within the RegistrationPresenter.php component. The root cause is the insertion of the raw FIRST_NAME registration value into an unencoded data-message attribute. An attacker can regis...

EUVD-2026-97630

Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRSTNAME registration value into an unencoded data-message attribute. Attackers can register with a double-quoted event handler that executes...