Platform
php
Component
xiaopi-panel
Fixed in
1.0.1
A cross-site scripting (XSS) vulnerability has been identified in Xiaopi Panel versions 1.0.0 through 1.0.0. This flaw resides within the /demo.php file of the WAF Firewall component and allows attackers to inject malicious scripts via manipulation of the 'param' argument. Remote exploitation is possible, and a public proof-of-concept exists, increasing the risk of immediate exploitation. A fix is pending.
Successful exploitation of CVE-2026-5332 allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser session. This can lead to various malicious outcomes, including session hijacking, credential theft, and defacement of the Xiaopi Panel interface. Given the public availability of an exploit, attackers can readily leverage this vulnerability to compromise systems running vulnerable versions of Xiaopi Panel. The potential blast radius extends to any user interacting with the compromised panel, as their actions could be manipulated by the attacker.
CVE-2026-5332 is considered a low-risk vulnerability due to its CVSS score of 3.5. However, the presence of a publicly available proof-of-concept significantly elevates the risk, as it lowers the barrier to entry for attackers. The vulnerability was disclosed on 2026-04-02, and the vendor has not responded. Active exploitation is possible given the public exploit.
Exploit Status
EPSS
0.03% (7% percentile)
CISA SSVC
Due to the lack of a vendor-provided patch, immediate mitigation strategies are crucial. Implement strict input validation and output encoding on the /demo.php endpoint to sanitize the 'param' argument. A Web Application Firewall (WAF) configured to block XSS payloads targeting this specific endpoint can provide an additional layer of defense. Regularly monitor access logs for suspicious activity, particularly requests containing unusual characters or patterns in the 'param' parameter. Until an official patch is released, these workarounds offer the best available protection.
Actualizar Xiaopi Panel a una versión posterior a 1.0.0, si existe, o deshabilitar/eliminar el componente WAF Firewall. Si no hay actualizaciones disponibles, considerar la mitigación del riesgo mediante la validación y limpieza de las entradas del usuario en el archivo /demo.php.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-5332 is a cross-site scripting (XSS) vulnerability affecting Xiaopi Panel versions 1.0.0-1.0.0, allowing attackers to inject malicious scripts via the /demo.php endpoint.
If you are running Xiaopi Panel version 1.0.0, you are potentially affected by this vulnerability. Immediate mitigation steps are recommended.
A vendor patch is currently unavailable. Implement input validation, output encoding, and WAF rules as temporary mitigations.
Due to the public availability of a proof-of-concept, active exploitation is possible and likely.
As of the disclosure date, the vendor has not released an official advisory. Monitor their website and security forums for updates.
CVSS Vector
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.