FastAdmin User Controller User.php login cross site scripting
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting, Code execution
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.
Summary
A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 1.2.1.20210731_beta is able to address this issue. The name of the patch is b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b. It is recommended to upgrade the affected component.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | FastAdmin | 1.2.0.20210401_beta | 1.2.1.20210731_beta | Patch available | CNA |
- FastAdmin Vendor— Affected 1.2.0.20210401_beta Fixed in 1.2.1.20210731_beta Patch available CNA
Remediation
- Fix · CNA FastAdmin Fixed in 1.2.1.20210731_beta
Timeline
- 2026-10-02 Threatist record created from CVE-2026-86244
- 2026-10-03 Alias added: GHSA-h6hc-9p4p-wf6h
References
Sources
- CVE-2026-86244 · CVE Program
- CVE-2026-86244 · NVD
- FIRST EPSS
- GHSA-h6hc-9p4p-wf6h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences