CVE-2026-109328 Details

A stored cross-site scripting vulnerability has been identified in Admidio versions 5.0.0 prior to 5.0.15. The issue resides in the RegistrationPresenter.php file, where the raw FIRST_NAME registration value is inserted into a data-message attribute without proper encoding. This vulnerability allows attackers to register with a name containing a double-quoted event handler, which executes JavaScript in an administrator's session when they hover over the entry on the Manage registrations page.

To address this vulnerability, ensure that name values are retrieved using the default encoded format or explicitly wrapped in a function that encodes HTML. Additionally, consider enabling Smarty's escape_html feature to automatically escape output, which would protect against this type of vulnerability across the application.