CVE-2026-121929 · Package
NO FIX YET
EmpireCMS up to version 8.0 does not properly handle the spacename argument in /e/member/mspace/index.php. An attacker can inject script that runs in a visitor's browser when they open a crafted link.
first public Nov 4, 2026 · 1 source
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running EmpireCMS up to version 8.0 that expose the member space page at /e/member/mspace/index.php are exposed. The sources do not say whether the page is reachable without an account or whether a default configuration is affected. Sites on other CMS products, or EmpireCMS versions above 8.0, are not affected by this report.
Not affected if version-above-8.0
Who cares cms, empirecms, php
No fix yet, per the sources.
A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. Impacted is an unknown function of the file /e/member/mspace/index.php. The manipulation of the argument spacename results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121929") · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.