CVE-2026-109328: Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name

Q: Who is exposed to this issue?

Admidio installations running versions 5.0.0 before 5.0.15 are affected where attackers can submit event registrations. Administrators who use the Manage registrations page are the users whose sessions can be targeted.

Q: What does an attacker need to do to exploit it?

The attacker does not need authentication, but must be able to register for an event and supply a crafted FIRST_NAME value containing a double-quoted event handler. The payload executes when an administrator hovers over the malicious registration entry on the Manage registrations page.

Q: How can administrators determine whether exploitation may have occurred?

Review event registration records for suspicious FIRST_NAME values, particularly values containing double quotes or event-handler-like text. Also assess whether an administrator may have hovered over any suspicious entries in Manage registrations.

Q: What is the available remediation?

Upgrade Admidio to version 5.0.15 or later. Until upgrading, restrict untrusted event registration submissions where possible and avoid hovering over suspicious registration entries in the Manage registrations page.

Published Oct 12, 2026

Updated

Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRSTNAME registration value into an unencoded data-message attribute. Attackers can register with a double-quoted event handler that executes JavaScript in an administrator's session when they hover the entry on the Manage registrations page.

Affected Software

1 affected component

Admidio Admidio>=5.0.0<5.0.15

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Admidio installations running versions 5.0.0 before 5.0.15 are affected where attackers can submit event registrations. Administrators who use the Manage registrations page are the users whose sessions can be targeted.

What does an attacker need to do to exploit it?

The attacker does not need authentication, but must be able to register for an event and supply a crafted FIRST_NAME value containing a double-quoted event handler. The payload executes when an administrator hovers over the malicious registration entry on the Manage registrations page.

How can administrators determine whether exploitation may have occurred?

Review event registration records for suspicious FIRST_NAME values, particularly values containing double quotes or event-handler-like text. Also assess whether an administrator may have hovered over any suspicious entries in Manage registrations.

What is the available remediation?

Upgrade Admidio to version 5.0.15 or later. Until upgrading, restrict untrusted event registration submissions where possible and avoid hovering over suspicious registration entries in the Manage registrations page.

CVE-2026-109328: Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

How can administrators determine whether exploitation may have occurred?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

How can administrators determine whether exploitation may have occurred?

What is the available remediation?