CVE-2026-112028

Received Received - Intake

Vote Handler X-Requested-With Header Logic Flaw

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulDB

Description

A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.class.php of the component Vote Handler. This manipulation of the argument X-Requested-With causes business logic errors. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-112028

EUVD

EUVD-2026-104012

Affected Vendors & Products

Vendor	Product	Version / Range
light0011	cms	c774dce31c6df0055568a8d5c53d964d99be199d
light0011	cms	f72cf46f601efb2a0618c3814cc2f61380b38930

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-840	Business Logic Errors

Attack-Flow Graph

Executive Summary

This vulnerability is in light0011 CMS, specifically in the VoteHandler component. It allows remote attackers to manipulate the X-Requested-With HTTP header, causing business logic errors. An exploit has been published and is publicly available.

Detection Guidance

This vulnerability involves manipulation of the X-Requested-With header in the VoteController.class.php file of light0011 CMS. To detect it, inspect HTTP requests targeting the VoteController for unusual or forged X-Requested-With headers. Check server logs for requests with this header set to unexpected values. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to disrupt normal CMS operations, potentially altering voting logic or other business functions. Since the exploit is public, unpatched systems are at risk of unauthorized manipulation.

Compliance Impact

The vulnerability allows manipulation of business logic via the X-Requested-With header, potentially leading to unauthorized data access or modification. This could impact compliance with GDPR by risking unauthorized processing of personal data and HIPAA by compromising protected health information integrity.

Mitigation Strategies

Immediately update or patch the light0011 CMS to the latest version if available. If no patch exists, consider disabling the VoteHandler component or restricting access to the vulnerable file App/Home/Controller/VoteController.class.php. Monitor network traffic for unusual activity related to the X-Requested-With header manipulation.

Hi! I’m here to help you understand CVE-2026-112028. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70