CVE-2026-36725

Name of the Vulnerable Software and Affected Versions FastapiAdmin version 2.2.0

Description A markdown based cross-site scripting (XSS) issue exists in the '/system/notice/create' endpoint. This allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the notice content parameter. Cross-site scripting (XSS) is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the notice content parameter in the '/system/notice/create' endpoint until the issue is resolved.