CVE-2026-3721

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3721", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-07T12:21:15.830Z", "datePublished": "2026-03-08T07:32:07.430Z", "dateUpdated": "2026-03-11T15:31:49.646Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-08T07:32:07.430Z"}, "title": "1024-lab/lab1024 SmartAdmin Help Documentation HelpDocAddForm.java cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "1024-lab", "product": "SmartAdmin", "versions": [{"version": "3.0", "status": "affected"}, {"version": "3.1", "status": "affected"}, {"version": "3.2", "status": "affected"}, {"version": "3.3", "status": "affected"}, {"version": "3.4", "status": "affected"}, {"version": "3.5", "status": "affected"}, {"version": "3.6", "status": "affected"}, {"version": "3.7", "status": "affected"}, {"version": "3.8", "status": "affected"}, {"version": "3.9", "status": "affected"}, {"version": "3.10", "status": "affected"}, {"version": "3.11", "status": "affected"}, {"version": "3.12", "status": "affected"}, {"version": "3.13", "status": "affected"}, {"version": "3.14", "status": "affected"}, {"version": "3.15", "status": "affected"}, {"version": "3.16", "status": "affected"}, {"version": "3.17", "status": "affected"}, {"version": "3.18", "status": "affected"}, {"version": "3.19", "status": "affected"}, {"version": "3.20", "status": "affected"}, {"version": "3.21", "status": "affected"}, {"version": "3.22", "status": "affected"}, {"version": "3.23", "status": "affected"}, {"version": "3.24", "status": "affected"}, {"version": "3.25", "status": "affected"}, {"version": "3.26", "status": "affected"}, {"version": "3.27", "status": "affected"}, {"version": "3.28", "status": "affected"}, {"version": "3.29", "status": "affected"}], "modules": ["Help Documentation Module"]}, {"vendor": "lab1024", "product": "SmartAdmin", "versions": [{"version": "3.0", "status": "affected"}, {"version": "3.1", "status": "affected"}, {"version": "3.2", "status": "affected"}, {"version": "3.3", "status": "affected"}, {"version": "3.4", "status": "affected"}, {"version": "3.5", "status": "affected"}, {"version": "3.6", "status": "affected"}, {"version": "3.7", "status": "affected"}, {"version": "3.8", "status": "affected"}, {"version": "3.9", "status": "affected"}, {"version": "3.10", "status": "affected"}, {"version": "3.11", "status": "affected"}, {"version": "3.12", "status": "affected"}, {"version": "3.13", "status": "affected"}, {"version": "3.14", "status": "affected"}, {"version": "3.15", "status": "affected"}, {"version": "3.16", "status": "affected"}, {"version": "3.17", "status": "affected"}, {"version": "3.18", "status": "affected"}, {"version": "3.19", "status": "affected"}, {"version": "3.20", "status": "affected"}, {"version": "3.21", "status": "affected"}, {"version": "3.22", "status": "affected"}, {"version": "3.23", "status": "affected"}, {"version": "3.24", "status": "affected"}, {"version": "3.25", "status": "affected"}, {"version": "3.26", "status": "affected"}, {"version": "3.27", "status": "affected"}, {"version": "3.28", "status": "affected"}, {"version": "3.29", "status": "affected"}], "modules": ["Help Documentation Module"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in 1024-lab/lab1024 SmartAdmin up to 3.29. The affected element is an unknown function of the file sa-base/src/main/java/net/lab1024/sa/base/module/support/helpdoc/domain/form/HelpDocAddForm.java of the component Help Documentation Module. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-07T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-07T13:26:27.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "din4 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/?id.349664", "name": "VDB-349664 | 1024-lab/lab1024 SmartAdmin Help Documentation HelpDocAddForm.java cross site scripting", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.349664", "name": "VDB-349664 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.765929", "name": "Submit #765929 | 1024-lab SmartAdmin \u22643.29 Stored Cross-Site Scripting (XSS)", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/SmartAdmin-Stored-Cross-Site-Scripting-XSS-in-HelpDoc-module-310ea92a3c418050852dc554e2b5b49b", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T15:31:40.536362Z", "id": "CVE-2026-3721", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T15:31:49.646Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3721", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-07T12:21:15.830Z", "datePublished": "2026-03-08T07:32:07.430Z", "dateUpdated": "2026-03-11T15:31:49.646Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-08T07:32:07.430Z"}, "title": "1024-lab/lab1024 SmartAdmin Help Documentation HelpDocAddForm.java cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "1024-lab", "product": "SmartAdmin", "versions": [{"version": "3.0", "status": "affected"}, {"version": "3.1", "status": "affected"}, {"version": "3.2", "status": "affected"}, {"version": "3.3", "status": "affected"}, {"version": "3.4", "status": "affected"}, {"version": "3.5", "status": "affected"}, {"version": "3.6", "status": "affected"}, {"version": "3.7", "status": "affected"}, {"version": "3.8", "status": "affected"}, {"version": "3.9", "status": "affected"}, {"version": "3.10", "status": "affected"}, {"version": "3.11", "status": "affected"}, {"version": "3.12", "status": "affected"}, {"version": "3.13", "status": "affected"}, {"version": "3.14", "status": "affected"}, {"version": "3.15", "status": "affected"}, {"version": "3.16", "status": "affected"}, {"version": "3.17", "status": "affected"}, {"version": "3.18", "status": "affected"}, {"version": "3.19", "status": "affected"}, {"version": "3.20", "status": "affected"}, {"version": "3.21", "status": "affected"}, {"version": "3.22", "status": "affected"}, {"version": "3.23", "status": "affected"}, {"version": "3.24", "status": "affected"}, {"version": "3.25", "status": "affected"}, {"version": "3.26", "status": "affected"}, {"version": "3.27", "status": "affected"}, {"version": "3.28", "status": "affected"}, {"version": "3.29", "status": "affected"}], "modules": ["Help Documentation Module"]}, {"vendor": "lab1024", "product": "SmartAdmin", "versions": [{"version": "3.0", "status": "affected"}, {"version": "3.1", "status": "affected"}, {"version": "3.2", "status": "affected"}, {"version": "3.3", "status": "affected"}, {"version": "3.4", "status": "affected"}, {"version": "3.5", "status": "affected"}, {"version": "3.6", "status": "affected"}, {"version": "3.7", "status": "affected"}, {"version": "3.8", "status": "affected"}, {"version": "3.9", "status": "affected"}, {"version": "3.10", "status": "affected"}, {"version": "3.11", "status": "affected"}, {"version": "3.12", "status": "affected"}, {"version": "3.13", "status": "affected"}, {"version": "3.14", "status": "affected"}, {"version": "3.15", "status": "affected"}, {"version": "3.16", "status": "affected"}, {"version": "3.17", "status": "affected"}, {"version": "3.18", "status": "affected"}, {"version": "3.19", "status": "affected"}, {"version": "3.20", "status": "affected"}, {"version": "3.21", "status": "affected"}, {"version": "3.22", "status": "affected"}, {"version": "3.23", "status": "affected"}, {"version": "3.24", "status": "affected"}, {"version": "3.25", "status": "affected"}, {"version": "3.26", "status": "affected"}, {"version": "3.27", "status": "affected"}, {"version": "3.28", "status": "affected"}, {"version": "3.29", "status": "affected"}], "modules": ["Help Documentation Module"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in 1024-lab/lab1024 SmartAdmin up to 3.29. The affected element is an unknown function of the file sa-base/src/main/java/net/lab1024/sa/base/module/support/helpdoc/domain/form/HelpDocAddForm.java of the component Help Documentation Module. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-07T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-07T13:26:27.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "din4 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/?id.349664", "name": "VDB-349664 | 1024-lab/lab1024 SmartAdmin Help Documentation HelpDocAddForm.java cross site scripting", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.349664", "name": "VDB-349664 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.765929", "name": "Submit #765929 | 1024-lab SmartAdmin \u22643.29 Stored Cross-Site Scripting (XSS)", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/SmartAdmin-Stored-Cross-Site-Scripting-XSS-in-HelpDoc-module-310ea92a3c418050852dc554e2b5b49b", "tags": ["exploit"]}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3721", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T15:31:40.536362Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T15:31:46.988Z"}}]}}

{"affected": [{"affectedData": [{"modules": ["Help Documentation Module"], "product": "SmartAdmin", "vendor": "1024-lab", "versions": [{"status": "affected", "version": "3.0"}, {"status": "affected", "version": "3.1"}, {"status": "affected", "version": "3.2"}, {"status": "affected", "version": "3.3"}, {"status": "affected", "version": "3.4"}, {"status": "affected", "version": "3.5"}, {"status": "affected", "version": "3.6"}, {"status": "affected", "version": "3.7"}, {"status": "affected", "version": "3.8"}, {"status": "affected", "version": "3.9"}, {"status": "affected", "version": "3.10"}, {"status": "affected", "version": "3.11"}, {"status": "affected", "version": "3.12"}, {"status": "affected", "version": "3.13"}, {"status": "affected", "version": "3.14"}, {"status": "affected", "version": "3.15"}, {"status": "affected", "version": "3.16"}, {"status": "affected", "version": "3.17"}, {"status": "affected", "version": "3.18"}, {"status": "affected", "version": "3.19"}, {"status": "affected", "version": "3.20"}, {"status": "affected", "version": "3.21"}, {"status": "affected", "version": "3.22"}, {"status": "affected", "version": "3.23"}, {"status": "affected", "version": "3.24"}, {"status": "affected", "version": "3.25"}, {"status": "affected", "version": "3.26"}, {"status": "affected", "version": "3.27"}, {"status": "affected", "version": "3.28"}, {"status": "affected", "version": "3.29"}]}, {"modules": ["Help Documentation Module"], "product": "SmartAdmin", "vendor": "lab1024", "versions": [{"status": "affected", "version": "3.0"}, {"status": "affected", "version": "3.1"}, {"status": "affected", "version": "3.2"}, {"status": "affected", "version": "3.3"}, {"status": "affected", "version": "3.4"}, {"status": "affected", "version": "3.5"}, {"status": "affected", "version": "3.6"}, {"status": "affected", "version": "3.7"}, {"status": "affected", "version": "3.8"}, {"status": "affected", "version": "3.9"}, {"status": "affected", "version": "3.10"}, {"status": "affected", "version": "3.11"}, {"status": "affected", "version": "3.12"}, {"status": "affected", "version": "3.13"}, {"status": "affected", "version": "3.14"}, {"status": "affected", "version": "3.15"}, {"status": "affected", "version": "3.16"}, {"status": "affected", "version": "3.17"}, {"status": "affected", "version": "3.18"}, {"status": "affected", "version": "3.19"}, {"status": "affected", "version": "3.20"}, {"status": "affected", "version": "3.21"}, {"status": "affected", "version": "3.22"}, {"status": "affected", "version": "3.23"}, {"status": "affected", "version": "3.24"}, {"status": "affected", "version": "3.25"}, {"status": "affected", "version": "3.26"}, {"status": "affected", "version": "3.27"}, {"status": "affected", "version": "3.28"}, {"status": "affected", "version": "3.29"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lab1024:smartadmin:*:*:*:*:*:*:*:*", "matchCriteriaId": "155AADC4-CFDA-4FF3-A384-DB9020EF695E", "versionEndIncluding": "3.29", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in 1024-lab/lab1024 SmartAdmin up to 3.29. The affected element is an unknown function of the file sa-base/src/main/java/net/lab1024/sa/base/module/support/helpdoc/domain/form/HelpDocAddForm.java of the component Help Documentation Module. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha identificado una debilidad en 1024-lab/lab1024 SmartAdmin hasta la versi\u00f3n 3.29. El elemento afectado es una funci\u00f3n desconocida del archivo sa-base/src/main/java/net/lab1024/sa/base/module/support/helpdoc/domain/form/HelpDocAddForm.java del componente M\u00f3dulo de Documentaci\u00f3n de Ayuda. Esta manipulaci\u00f3n causa cross site scripting. El ataque puede ser iniciado remotamente. El exploit ha sido puesto a disposici\u00f3n del p\u00fablico y podr\u00eda ser utilizado para ataques. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-3721", "lastModified": "2026-06-17T10:44:04.487", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3721", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T15:31:40.536362Z", "version": "2.0.3"}}]}, "published": "2026-03-08T08:16:00.227", "references": [{"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.349664"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.349664"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.765929"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.notion.so/SmartAdmin-Stored-Cross-Site-Scripting-XSS-in-HelpDoc-module-310ea92a3c418050852dc554e2b5b49b"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.17"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.19"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.22"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.23"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.24"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.25"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.26"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.27"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.28"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.29"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SmartAdmin", "source": "cna", "vendor": "1024-lab"}, "product": "smartadmin", "vendor": "1024-lab"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.17"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.19"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.22"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.23"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.24"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.25"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.26"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.27"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.28"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.29"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SmartAdmin", "source": "cna", "vendor": "lab1024"}, "product": "smartadmin", "vendor": "lab1024"}], "analysis": {"en": {"generated_at": "2026-04-17T12:01:51.349852+00:00", "value": {"mitigation_remediation": ["Upgrade SmartAdmin to a version newer than 3.29 once the vendor releases a patch.", "Sanitize all user\u2011supplied data for the HelpDocAddForm and apply proper output encoding to eliminate the execution of injected scripts.", "Implement a strict Content Security Policy that disallows inline script execution and limits trusted script sources."], "summary": {"action": "Apply Patch", "impact": "Client\u2011side script execution via XSS in SmartAdmin Help Documentation"}, "threat_synthesis": {"affected_systems": "SmartAdmin versions up to 3.29 from both 1024\u2011lab and lab1024 are affected. Any installation that includes the Help Documentation module in these releases is vulnerable.", "description_and_impact": "A weakness in SmartAdmin\u2019s HelpDocAddForm component enables malicious script injection. The vulnerability is triggered when an attacker crafts input that is rendered in the Help Documentation module, causing browsers of users who view the page to execute the injected code. This can lead to theft of session data, defacement, or further exploitation within the user\u2019s context.", "risk_and_exploitability": "The CVSS score of 5.1 denotes moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in CISA\u2019s KEV catalog. Attackers can potentially deliver the payload remotely by sending crafted requests that influence the HelpDocAddForm endpoint, after which legitimate users will become victims when they access the compromised documentation."}}}}, "created": "2026-03-09T10:03:24.863398+00:00", "updated": "2026-04-17T12:15:18.156657+00:00", "vendors": ["1024-lab", "1024-lab$PRODUCT$smartadmin", "lab1024", "lab1024$PRODUCT$smartadmin"]}