CVE-2026-44956: Stored XSS in Userlog Details via Full Name Field

Technical summary

This vulnerability is a classic stored XSS flaw (CWE-79) where user input—specifically the Full Name field—is incorporated into system-generated emails without proper output encoding. The email content is persisted in the userlog table's details field. When an admin user retrieves and displays this content through userlog-details.php, the browser renders the stored payload as executable JavaScript because the output lacks HTML entity encoding or equivalent escaping. An attacker with low privileges can craft a malicious name containing script tags or event handlers, which remains dormant until an admin accesses the affected email record. The fix involves implementing context-appropriate output sanitization on the userlog details view.

Business impact

This vulnerability creates a direct path for low-privileged users to compromise administrator accounts. By injecting JavaScript through their Full Name, an attacker can steal admin session cookies, capture credentials, modify user records, or perform other actions as the logged-in administrator. The attack requires no external infrastructure and leaves a persistent record in the userlog, making detection dependent on examining email content. Organizations using this system may face unauthorized privilege escalation, data tampering, or unauthorized account modifications if the issue remains unpatched.

Affected systems

The vendor and product information is not provided in the source data. Organizations should verify which systems or software versions are affected by consulting the relevant vendor advisory or changelog. The vulnerability specifically impacts the userlog-details.php component and any functionality that displays user full names within system-generated emails stored in the userlog table.

Exploitability

Exploitability is straightforward. Any user account with the ability to set or modify their Full Name can inject malicious JavaScript. No special privileges or complex multi-step interactions are required beyond creating an account with a payload-containing name. The attack is reliably triggered when an administrator views the corresponding email content, making it a practical attack vector for users seeking to escalate privileges or manipulate system data. The CVSS score of 0.0 (NONE severity) reflects the requirement for user interaction and low-privileged attacker status, though the practical risk to administrative functions should not be underestimated.

Remediation

The vulnerability has been addressed by implementing proper output sanitization in the userlog details output handler. Organizations should immediately apply patches that include HTML entity encoding or equivalent escaping for the Full Name field when it is displayed in email content or logs. Additionally, review any existing userlog records for suspicious Full Name entries that may contain script tags, event handlers, or encoded payloads. Consider implementing Content Security Policy (CSP) headers to mitigate XSS impact even if sanitization is bypassed.

Patch guidance

Verify with your vendor's security advisory for specific patch version numbers and deployment instructions. The fix involves updating the userlog-details.php component to properly escape output when rendering user full names and email content. Apply patches during a maintenance window and verify the escaping is active by testing with sample payloads in a non-production environment. Ensure all instances of userlog content display are protected, not just the primary details view.

Detection guidance

Monitor for Full Name fields containing common XSS payloads such as <script>, javascript:, onerror=, onload=, or event handler attributes. Review userlog table records created before the patch date for suspicious name entries. Enable web application firewall (WAF) rules to block Full Name submissions containing script tags or encoded JavaScript. Track access to userlog-details.php by admin users and correlate with unusual account activity. Implement logging of Full Name modifications to detect when low-privileged users attempt to inject code.

Why prioritize this

Although the CVSS score is 0.0, this vulnerability should be prioritized for patching because it directly enables privilege escalation from low-privileged users to administrators. The attack is trivial to execute, requires no social engineering, and leaves persistent artifacts in system logs. The impact—compromise of admin accounts—is severe even if the baseline score is low. Apply patches promptly in development and production environments.

Risk score, explained

The CVSS:3.0 score of 0.0 (NONE) reflects the attack vector (Network), low attack complexity, no privileges required, no user interaction beyond admin viewing logs, and unchanged confidentiality, integrity, and availability from the perspective of the system as a whole. However, this score does not fully capture the business risk: an attacker with low privileges can compromise high-privilege accounts. Use this score as a baseline but assess actual organizational risk based on the number of administrators who access userlog details and the sensitivity of user data in your system.

Frequently asked questions