CVE-2026-51565

22th percentile - higher than 22% of all known CVEs

In Milk admin version 0.9.8 and earlier, a cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request.

An attacker can inject malicious script that executes in the administrator's browser, potentially leading to session theft, configuration changes, or other harmful actions.

Update Milk admin to a version later than 0.9.8, which contains the fix for this vulnerability.