CVE-2026-3721Disclosure(lab1024 / smartadmin)

LOWCVSS 5.4 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for lab1024 smartadmin systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

A weakness has been identified in 1024-lab/lab1024 SmartAdmin up to 3.29. The affected element is an unknown function of the file sa-base/src/main/java/net/lab1024/sa/base/module/support/helpdoc/domain/form/HelpDocAddForm.java of the component Help Documentation Module. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

lab1024 CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://www.notion.so/SmartAdmin-Stored-Cross-Site-Scripting-XSS-in-HelpDoc-module-310ea92a3c418050852dc554e2b5b49b

Vendor / third-party advisories

Other references

https://vuldb.com/?ctiid.349664

Weakness type (CWE)

CWE-79CWE-94

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

smartadmin

Threat summary

Active exploitation appears in 1 classified signals
3 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-03-08); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

lab1024

Products

smartadmin

Deep dive

Activity timeline3 mentions / 2d

Signal classification3 categories

Disclosure

133.3%

General

133.3%

Active Exploitation

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-08	2	Disclosure1General1
2026-04-18	1	Active Exploitation1

Full discourse3 posts

Ape Manor@apemanor175d
Active Exploitation
📰 Mirai Variant Nexcorium Exploits CVE-2026-3721 to Hijack TBK DVRs for DDoS Botnet A new cyber threat has emerged as the Nexcorium variant of the Mirai botnet begins... Thoughts? 💬 👉 https://apemanor.com/article/49727c58-f4d8-42e5-a86d-2929c5425a7e #Tech #News #Discussion https://t.co/l9ApmIMjy4
Post summary
The tweet reports that the Nexcorium Mirai variant is actively exploiting CVE‑2026‑3721 to hijack TBK DVRs for a DDoS botnet, without mentioning PoC, tooling, patches, or false‑positive claims.
0000053
51 followersView on X
CVE@CVEnew215d
General
CVE-2026-3721 A weakness has been identified in 1024-lab/lab1024 SmartAdmin up to 3.29. The affected element is an unknown function of the file sa-base/src/main/java/net/lab1024/sa/b… https://www.cve.org/CVERecord?id=CVE-2026-3721
Post summary
The text announces a new CVE for SmartAdmin, noting a weakness in an unspecified function, but provides no further technical details, exploits, or mitigation information.
00000108
56.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds216d
Disclosure
CVE-2026-3721 Cross-Site Scripting in SmartAdmin Help Documentation Module up to 3.29 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3721
Post summary
The provided text announces CVE-2026-3721, a Cross‑Site Scripting vulnerability in SmartAdmin Help Documentation Module up to version 3.29, with no details on exploitation, PoC, or fixes.
0000048
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	lab1024	smartadmin	-	-	-

Explore more

Back to dashboard lab1024 CVEs smartadmin vulnerabilities