CVE-2026-52307: Stored XSS in 1CMS v5.6
CVE-2026-52307: authenticated stored XSS in 1CMS (ClassCMS) v5.6 Column Management lets attackers inject scripts via the title field.
ClassCMS 1CMS v5.6 contains an authenticated stored cross-site scripting vulnerability, CVE-2026-52307, in the Column Management component. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the title field. No CVSS score, patch information, or exploitation evidence was provided in the disclosure.
- CVE-2026-52307: authenticated stored XSS in Column Management
- Payload injected via the title field executes in browsers
- Affects 1CMS (ClassCMS) version 5.6
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-52307 | Authenticated Stored XSS in ClassCMS 1CMS v5.6 Column Management | 5.4 | <1% | PoC |
From the original article
Posted by 懒-癌-症～ via Fulldisclosure on Sep 08 CVE-2026-52307: 1CMS v5. 6 Authenticated Stored XSS Vulnerability Vulnerability Description An authenticated stored cross-site scripting (XSS) vulnerability exists in the Column Management component of ClassCMS 1CMS v5. 6.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.