Home / Vulnerability Intelligence / CVE-2026-30661

CVE-2026-30661 - Vulnerability Analysis

MediumCVSS: 6.1

Last Updated: March 25, 2026

iCMS - Stored XSS

Published: March 24, 2026Updated: March 25, 2026PoC AvailableRemote Exploitable

Overview

iCMS v8.0.0 contains a stored XSS vulnerability caused by improper sanitization of regip and loginip parameters in User Management index.html, letting remote attackers execute arbitrary web scripts.

Severity & Score

Severity: Medium

CVSS Score: 6.1

Impact

Remote attackers can execute arbitrary scripts, potentially hijacking user sessions or defacing web content.

Mitigation

Update to the latest version of iCMS.

References

https://wang1rrr.github.io/2026/02/09/CVE-Report-iCMS-v8.0.0-XSS/

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-30661
Severity: Medium
CVSS Score: 6.1
Type: stored_xss
Status: confirmed

CWE

CWE-79

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N