CVE-2026-5332— Xiaopi Panel WAF Firewall demo.php cross site scripting
Quick assessment
Affected
Xiaopi Panel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Henan Xiaopi Panel是中国河南小皮（Henan Xiaopi）公司的一个Linux图形化界面。 Henan Xiaopi Panel 1.0.0版本存在代码注入漏洞，该漏洞源于组件WAF Firewall的文件/demo.php中对参数param的操作不当，可能导致跨站脚本攻击。
Possible ATT&CK Techniques 1 AI
T1059.001 · PowerShell
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-5332
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Xiaopi Panel WAF Firewall demo.php cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was identified in Xiaopi Panel 1.0.0. This vulnerability affects unknown code of the file /demo.php of the component WAF Firewall. The manipulation of the argument param leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Henan Xiaopi Panel 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Henan Xiaopi Panel是中国河南小皮（Henan Xiaopi）公司的一个Linux图形化界面。 Henan Xiaopi Panel 1.0.0版本存在代码注入漏洞，该漏洞源于组件WAF Firewall的文件/demo.php中对参数param的操作不当，可能导致跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-5332
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-5332
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-5332 (2)
-
🔗 Submit #780839: Xiaopi Web Application Firewall V1.0.0 Bypass Read full article third-party-advisory
-
🔗 CVE-2026-5332 Xiaopi Panel WAF Firewall demo.php cross site scripting Read full article vdb-entry technical-description
IV. Related Vulnerabilities
Same product: Panel
-
CVE-2024-58389
HoloViz Panel from 1.2.2 before 1.9.0 Open Redirect via next -
CVE-2026-92762
Pelican Panel before 1.0.0-beta35 Authorization Bypass via S -
CVE-2026-86177
Pterodactyl Panel before 1.14.1 Privilege Escalation via Sch -
CVE-2026-61609
Pterodactyl's shared global rate-limit key on login and 2FA -
CVE-2026-54593
Pterodactyl's improper JWT scoping allows subuser to upload
Same weakness: CWE-79
-
CVE-2026-91159
Discourse: Stored oEmbed HTML injection via allowed iframe -
CVE-2026-89069
MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages -
CVE-2026-60008
Gitea Jupyter notebook UI redress through CSS class injectio -
CVE-2026-110627
ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo -
CVE-2026-110626
ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_lang
V. Comments for CVE-2026-5332
No comments yet