PT-2026-29739 · Unknown · Xiaopi Panel

Customer · Published 2026-04-02 · Updated 2026-04-02 · CVE-2026-5332

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

**Name of the Vulnerable Software and Affected Versions Xiaopi Panel version 1.0.0

Description A flaw exists in Xiaopi Panel 1.0.0 within the WAF Firewall component, specifically in the file /demo.php. Manipulation of the param argument can lead to cross-site scripting. Remote exploitation is possible, and the exploit is publicly available.

Recommendations Disable or restrict access to the /demo.php file within the WAF Firewall component.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-5332

Affected Products

Xiaopi Panel

References · 6

• 🔥 https://github.com/ltranquility/vuln_submit/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5332 · Security Note
• https://vuldb.com/vuln/354666 · Note
• https://vuldb.com/vuln/354666/cti · Note
• https://vuldb.com/submit/780839 · Note
• https://twitter.com/CVEnew/status/2039744352801472651 · Twitter Post