{"id":"CVE-2026-116100","kind":"vulnerability","aliases":["CVE-2026-116100"],"related":[],"title":"gougucms: User Level add function lets Title field run cross-site scripting","description":"A vulnerability has been found in gougucms up to 4.08.18. Impacted is the function Add of the file app/admin/controller/Level.php of the component User Level Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"gougucms up to version 4.08.18 does not sanitize the Title argument in the Add function of app/admin/controller/Level.php, which handles user levels. An attacker can inject script that runs in the browser of a user who views the affected page.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gougucms","other","php","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed gougucms version against `4.08.18`, unknown whether later versions are patched\n- Review `app/admin/controller/Level.php` for the Add function and whether the Title input is escaped on output","fix":null,"status":"open","published_at":"2026-10-26T01:17:15+00:00","first_seen_at":"2026-10-26T01:38:48+00:00","triaged_at":"2026-10-26T01:40:56+00:00","updated_at":"2026-10-26T01:40:56+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-26T01:40:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"gougucms: User Level add function lets Title field run cross-site scripting","impact":"medium","summary":"gougucms up to version 4.08.18 does not sanitize the Title argument in the Add function of app/admin/controller/Level.php, which handles user levels. An attacker can inject script that runs in the browser of a user who views the affected page.","category":"other","nicknames":[],"who_cares":["gougucms","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"script runs in admin's browser, session may be hijacked","analyst_note":"Confirm the fixed version and whether the admin Level add form requires login; check the NVD page for the vendor response and any patch.","how_to_check":"- Check the installed gougucms version against `4.08.18`, unknown whether later versions are patched\n- Review `app/admin/controller/Level.php` for the Add function and whether the Title input is escaped on output","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Sites running gougucms up to and including 4.08.18 where administrators can add user levels. The sources do not say which deployments or roles are most exposed. Installations on newer versions or without this admin module are likely not affected, but the sources do not confirm a fixed version.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000578,"input_tokens":3336,"output_tokens":488,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116100':16A,19A '-2026':15A,18A '4.08.18':30B,74C 'add':4A,39B,79C 'affect':63B 'app/admin/controller/level.php':42B,83C 'argument':36B,94C 'attack':48B,102C 'browser':56B 'carri':107C 'compon':86C 'contact':125C 'cross':11A,98C 'cross-sit':10A 'cve':14A,17A 'disclos':114C 'disclosur':129C 'earli':126C 'exploit':111C 'field':8A 'file':82C 'found':69C 'function':5A,40B,78C 'gougucm':1A,20B,26B,71C 'handl':44B 'handler':89C 'host':25B 'impact':75C 'inject':50B 'lead':96C 'let':6A 'level':3A,46B,88C 'manipul':91C 'may':119C 'page':64B 'php':22B 'possibl':104C 'public':117C 'remot':109C 'respond':133C 'run':9A,53B 'sanit':33B 'script':13A,51B,100C 'self':24B 'self-host':23B 'site':12A,99C 'titl':7A,35B,95C 'use':121C 'user':2A,45B,59B,87C 'vendor':123C 'version':29B 'view':61B 'vulner':66C 'way':136C","nicknames":[],"mitigations":[],"who_affected":"Sites running gougucms up to and including 4.08.18 where administrators can add user levels. The sources do not say which deployments or roles are most exposed. Installations on newer versions or without this admin module are likely not affected, but the sources do not confirm a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T01:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116100","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116100","severity":null,"published_at":"2026-10-26T01:17:15+00:00","modified_at":"2026-10-26T01:17:15+00:00","first_seen_at":"2026-10-26T01:38:48+00:00","fetched_at":"2026-10-26T01:38:48+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}