PT-2026-29447 · Unknown · Z-9527 Admin

Vuldb · Published 2026-04-01 · Updated 2026-04-01 · CVE-2026-5252

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions z-9527 admin versions 1.0 through 2.0

Description A security flaw has been discovered in z-9527 admin versions 1.0 and 2.0. The issue affects an unknown function within the /server/routes/message.js file of the Message Create Endpoint component. Manipulation of this component can lead to cross site scripting. The attack can be initiated remotely. The exploit has been released publicly and may be used for attacks. The vendor was contacted regarding this disclosure but did not respond.

Recommendations For z-9527 admin version 1.0, address the cross site scripting issue in the /server/routes/message.js file of the Message Create Endpoint component. For z-9527 admin version 2.0, address the cross site scripting issue in the /server/routes/message.js file of the Message Create Endpoint component.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-5252

Affected Products

Z-9527 Admin

References · 7

• 🔥 https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-10 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5252 · Security Note
• https://vuldb.com/vuln/354442 · Note
• https://twitter.com/CVEnew/status/2039279681070072062 · Twitter Post
• https://twitter.com/CVEarity/status/2039321062249537627 · Twitter Post
• https://vuldb.com/submit/780613 · Note
• https://vuldb.com/vuln/354442/cti · Note