CVE-2026-75933 in Jet Admin
Summary
by MITRE • 08/21/2026
Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified within Jet Admin represents a classic Stored Cross-Site Scripting (XSS) flaw, specifically targeting administrative configuration interfaces that allow for the customization of visual elements such as scripts and stylesheets on the sign-in page. This security defect arises from insufficient input validation and sanitization mechanisms when processing user-supplied data intended to modify the frontend presentation layer. Because Jet Admin is an enterprise-grade administration tool often used by organizations to manage databases, servers, and other critical infrastructure components, the trust boundary between administrative actions and end-user interactions becomes a significant attack surface. The flaw permits an authenticated attacker with access to these configuration settings to inject malicious JavaScript code that persists within the application's state rather than being transient or session-specific.
From a technical perspective, the core issue lies in the failure of the server-side processing logic to properly encode or escape special characters before rendering them back into HTML documents served to clients. When an administrator configures custom scripts for the login interface, these inputs are stored directly without adequate sanitization checks against script injection patterns. Consequently, when any user subsequently accesses the sign-in page, the browser parses and executes the injected code as if it were legitimate application content. This execution occurs within the same origin context as the Jet Admin instance, granting the malicious scripts full access to cookies, session tokens, local storage data, and other sensitive information associated with that domain.
The operational impact of this vulnerability is severe due to its persistent nature and broad reach. Unlike reflected XSS which requires tricking a specific user into clicking a crafted link, stored XSS affects every visitor who loads the compromised page. In an enterprise environment where Jet Admin serves as a central hub for IT operations, compromising the sign-in page can lead to widespread session hijacking. Attackers can steal administrative credentials or active sessions of other administrators and users, potentially leading to unauthorized access to sensitive databases, modification of system configurations, or exfiltration of proprietary data. Furthermore, because the attack vector is embedded in a high-traffic entry point like the login screen, the probability of successful exploitation against multiple targets increases significantly compared to less visible areas of an application.
This vulnerability aligns with CWE-79, which categorizes improper neutralization of input during web page generation as Cross-site Scripting. It also maps directly to MITRE ATT&CK technique T1059.007, specifically the JavaScript subtechnique under Command and Control or Collection phases depending on the payload's intent. The persistence mechanism described falls under Persistence tactics where attackers maintain footholds by modifying application settings that are automatically executed upon user interaction.
Mitigation strategies must focus on rigorous input validation and output encoding practices. Developers should implement strict allow-listing for any custom script content, ensuring only predefined safe functions or libraries can be utilized rather than arbitrary code execution. Additionally, implementing Content Security Policy (CSP) headers is critical to restrict the sources from which scripts can be loaded and executed, thereby neutralizing injected payloads even if they bypass input filters. On the application side, all user-supplied data destined for HTML rendering must undergo context-aware encoding to prevent browser interpretation of malicious markup as executable code. Regular security audits focusing on stored XSS vectors in administrative panels are essential to maintain the integrity of enterprise management tools.