Description
Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to execute code in users- browsers and hijack sessions.
CVSS 6.5EPSS 0.22499999999999998%Risque 0.66
Voir la source- Publication
- 2026-08-03 14:16:29
- Dernière modification
- 2026-08-03 15:16:21
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N