CVE-2026-6184 - Vulnerability Analysis

Overview

code-projects Simple Content Management System 1.0 contains a stored XSS caused by manipulation of the "News Title" argument in /web/admin/welcome.php, letting remote attackers execute scripts, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can execute arbitrary scripts, potentially leading to session hijacking or user impersonation.

Mitigation

Update to the latest version of Simple Content Management System.

References

• https://code-projects.org/
• https://github.com/Xmyronn/simple-cms-stored-xss-news-title
• https://vuldb.com/submit/797265
• https://vuldb.com/vuln/357107
• https://vuldb.com/vuln/357107/cti

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner