{"id":"CVE-2026-116623","kind":"vulnerability","aliases":["CVE-2026-116623"],"related":[],"title":"Simple Content Management System: admin page lacks authorization checks","description":"A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used.","summary":"Simple Content Management System 1.0 by code-projects has a flaw in its admin welcome page (web/admin/welcome.php) where the addnews argument is processed without an authorization check. A remote attacker can use the public exploit to perform admin-level actions such as adding news entries.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","php","self-hosted"],"not_affected_if":["admin-not-exposed"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-27T01:19:06+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:16+00:00","updated_at":"2026-10-27T01:36:16+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-27T01:36:16Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Simple Content Management System: admin page lacks authorization checks","impact":"medium","summary":"Simple Content Management System 1.0 by code-projects has a flaw in its admin welcome page (web/admin/welcome.php) where the addnews argument is processed without an authorization check. A remote attacker can use the public exploit to perform admin-level actions such as adding news entries.","category":"other","nicknames":[],"who_cares":["php","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker performs admin actions without logging in","analyst_note":"Check the NVD entry and the exploit's public source to confirm whether login is required, what actions addnews allows, and whether a fixed version exists.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["admin-not-exposed"],"who_is_affected":"Sites running the code-projects Simple Content Management System 1.0 with its admin interface reachable from the network are likely affected. Installations where the admin directory is blocked from outside access or that do not run this project can skip it. unknown whether the sources list a patched release.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00055,"input_tokens":3309,"output_tokens":439,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116623':12A,15A '-2026':11A,14A '/web/admin/welcome.php':89C '1.0':25B,80C 'action':62B 'add':65B 'addnew':41B,100C 'admin':5A,35B,60B,93C 'admin-level':59B 'argument':42B,99C 'attack':51B,106C 'author':8A,47B,104C 'check':9A,48B 'code':28B,74C 'code-project':27B,73C 'compon':92C 'content':2A,22B,77C 'cve':10A,13A 'detect':71C 'entri':67B 'exploit':56B,112C 'file':88C 'flaw':32B 'function':85C 'host':20B 'impact':81C 'interfac':94C 'lack':7A 'launch':109C 'level':61B 'manag':3A,23B,78C 'manipul':96C 'may':117C 'miss':103C 'news':66B 'page':6A,37B 'perform':58B 'php':17B 'process':44B 'project':29B,75C 'public':55B,115C 'remot':50B,110C 'result':101C 'self':19B 'self-host':18B 'simpl':1A,21B,76C 'system':4A,24B,79C 'unknown':84C 'use':53B,119C 'vulner':69C 'web/admin/welcome.php':38B 'welcom':36B 'without':45B","nicknames":[],"mitigations":[],"who_affected":"Sites running the code-projects Simple Content Management System 1.0 with its admin interface reachable from the network are likely affected. Installations where the admin directory is blocked from outside access or that do not run this project can skip it. unknown whether the sources list a patched release.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116623","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116623","severity":null,"published_at":"2026-10-27T01:19:06+00:00","modified_at":"2026-10-27T01:19:06+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}