---
id: "CVE-2026-121929"
kind: "vulnerability"
aliases: ["CVE-2026-121929"]
title: "EmpireCMS: spacename parameter in member space page allows cross-site scripting"
severity: "medium"
cvss: 4.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cms", "empirecms", "package", "php"]
not_affected_if: ["version-above-8.0"]
published_at: "2026-11-04T19:17:32+00:00"
first_seen_at: "2026-11-04T19:28:48+00:00"
updated_at: "2026-11-04T19:30:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121929", "first_seen_at": "2026-11-04T19:28:48+00:00"}]
---

# EmpireCMS: spacename parameter in member space page allows cross-site scripting

EmpireCMS up to version 8.0 does not properly handle the spacename argument in /e/member/mspace/index.php. An attacker can inject script that runs in a visitor's browser when they open a crafted link.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the EmpireCMS version in use is 8.0 or lower.
- Look for the file /e/member/mspace/index.php on the site.

## Timeline

- 2026-11-04T19:28:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121929

## From the sources

A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. Impacted is an unknown function of the file /e/member/mspace/index.php. The manipulation of the argument spacename results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_