Description

Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-31T21:17:53.073Z",
  "pubdate": "2026-08-31T21:17:53.073Z",
  "executiveSummary": "RegistrationMagic versions 6.0.9.8 and below are vulnerable to an unauthenticated Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability stems from improper neutralization of user-supplied input before reflecting it back to the web browser.\nSuccessful exploitation allows an unauthenticated remote attacker to execute arbitrary JavaScript within the context of a victim's session.\nThe impact includes potential session hijacking, unauthorized actions performed on behalf of the user, theft of sensitive information, or redirection to malicious sites.\nBecause the vulnerability is unauthenticated, it presents a significant risk as no prior access to the application is required to initiate an attack.\nThe vulnerability affects all users who interact with the impacted registration forms, including administrators viewing logs or submissions.",
  "technicalDetails": "The vulnerability resides within the input handling logic of RegistrationMagic versions <= 6.0.9.8, where user-supplied data is inadequately sanitized or encoded before being rendered in the application interface.\nThis failure to adhere to secure coding practices—specifically, the lack of context-aware output encoding—allows an attacker to inject arbitrary HTML and script tags into the application.\nThe attack flow begins with an unauthenticated attacker crafting a malicious payload containing JavaScript, typically injected into input fields designed to capture registration information.\nWhen a user, particularly an administrator with higher privileges, accesses a dashboard or administrative page where this input is rendered, the browser interprets the payload as legitimate code.\nBecause the payload is stored or reflected directly in the application's response, the malicious JavaScript executes in the context of the user's browser session, bypassing Same-Origin Policy (SOP) protections.\nExploitation does not require authentication, meaning an attacker can trigger this condition simply by submitting a registration form or interacting with accessible public endpoints that echo inputs without proper filtering.\nPost-exploitation impact is severe, as the attacker can gain full access to the victim's session tokens, perform unauthorized administrative actions, or inject malicious content into other parts of the site to facilitate further attacks.\nThe vulnerable component is the submission handling module, which fails to treat input as untrusted data. By reflecting this data back to the application user interface (UI) without encoding, the component creates an open vector for stored or reflected XSS attacks.\nThe vulnerability exists entirely within the application layer, and network exposure is high as the vulnerable components are typically accessible from any public-facing registration portal."
}