Live › vulnerability › CVE-2026-116100
Go to dashboardgougucms up to version 4.08.18 does not sanitize the Title argument in the Add function of app/admin/controller/Level.php, which handles user levels. An attacker can inject script that runs in the browser of a user who views the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 01:38 UTC. All times on this page are UTC.
Sites running gougucms up to and including 4.08.18 where administrators can add user levels. The sources do not say which deployments or roles are most exposed. Installations on newer versions or without this admin module are likely not affected, but the sources do not confirm a fixed version.
No product ranges from the sources yet.
4.08.18, unknown whether later versions are patchedapp/admin/controller/Level.php for the Add function and whether the Title input is escaped on outputUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in gougucms up to 4.08.18. Impacted is the function Add of the file app/admin/controller/Level.php of the component User Level Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116100")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.