CVE-2026-86244: Cross Site Scripting in FastAdmin
Description
CVE-2026-86244 is a cross-site scripting (XSS) vulnerability in FastAdmin affecting the register/login function in the User Controller component. The vulnerability exists in versions up to 1.2.0.20210401_beta and allows remote attackers to manipulate the 'url' argument to execute XSS attacks. A patch is available in version 1.2.1.20210731_beta to address this issue.
CVSS v4.0
Score 5.3medium
Affected software
FastAdmin
cpe:2.3:a:fastadmin:fastadmin:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in FastAdmin's User Controller (application/index/controller/User.php) allows remote attackers to perform cross-site scripting by manipulating the 'url' parameter in the register/login function. The flaw affects FastAdmin versions up to 1.2.0.20210401_beta. The issue has been publicly disclosed, and a patch identified by commit b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b is included in FastAdmin version 1.2.1.20210731_beta.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser via the vulnerable 'url' parameter during registration or login. This can lead to session hijacking, phishing, or other malicious actions within the affected application context. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, no privileges required, and user interaction needed.
Mitigation Recommendations
Upgrade FastAdmin to version 1.2.1.20210731_beta or later, which contains the official fix for this vulnerability. Applying this update will remediate the cross-site scripting issue. No additional vendor advisories indicate other mitigation steps or that no action is required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-06T09:35:07.004Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9e18f5acd9273b49c0daf3
Added to database: 09/07/2026, 01:52:53 UTC
Last enriched: 09/15/2026, 00:54:44 UTC
Last updated: 10/21/2026, 13:20:24 UTC
Views: 104
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.