CVE-2026-5252

LOW

z-9527 admin Message Create Endpoint message.js cross site scripting

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-5252. PoCs published by aydin5245.

AI-analyzed exploit summary The repository contains only a minimal README with no technical details or exploit code. The content is nonsensical and lacks any meaningful information about CVE-2026-5252 or Ivanti.

Description

A security flaw has been discovered in z-9527 admin 1.0/2.0. Affected is an unknown function of the file /server/routes/message.js of the component Message Create Endpoint. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Exploits (1)

github STUB
by aydin5245 · poc
https://github.com/aydin5245/CVE-2026-5252-CVE-POC-ivanti

The repository contains only a minimal README with no technical details or exploit code. The content is nonsensical and lacks any meaningful information about CVE-2026-5252 or Ivanti.

Classification
Stub 95%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown (claimed to be Ivanti)
No auth needed
devstral-2 · analyzed May 01, 2026 Full analysis →

References (4)

Core 4
Core References
Vdb Entry vdb-entry
VDB-354442 | z-9527 admin Message Create Endpoint message.js cross site scripting
https://vuldb.com/vuln/354442
Signature, Permissions Required signature permissions-required
VDB-354442 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/354442/cti
Third Party Advisory third-party-advisory
Submit #780613 | z-9527 admin ≤ commit 72aaf2d Cross Site Scripting
https://vuldb.com/submit/780613

Scores

CVSS v3 3.5
EPSS 0.0027
EPSS Percentile 18.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (2)
z-9527/admin 1.0
z-9527/admin 2.0
Published Apr 01, 2026
Tracked Since Apr 01, 2026