CVE-2026-5252 - Vulnerability Analysis

Overview

z-9527 admin 1.0/2.0 contains a stored XSS caused by input manipulation in /server/routes/message.js Message Create Endpoint, letting remote attackers execute scripts, exploit requires crafted input.

Severity & Score

Impact

Remote attackers can execute scripts in users' browsers, potentially stealing data or performing actions on behalf of users.

Mitigation

Update to the latest version or apply vendor patches addressing the XSS vulnerability.

References

• https://vuldb.com/vuln/354442
• https://vuldb.com/vuln/354442/cti
• https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-10
• https://vuldb.com/submit/780613

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner