CVE-2026-116100
Received Received - Intake

Cross-Site Scripting in GouguCMS User Level Handler

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A vulnerability has been found in gougucms up to 4.08.18. Impacted is the function Add of the file app/admin/controller/Level.php of the component User Level Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116100
EUVD
EUVD-2026-109585

Affected Vendors & Products

Showing 19 associated CPEs
Vendor Product Version / Range
n/a gougucms 4.08.0
n/a gougucms 4.08.1
n/a gougucms 4.08.2
n/a gougucms 4.08.3
n/a gougucms 4.08.4
n/a gougucms 4.08.5
n/a gougucms 4.08.6
n/a gougucms 4.08.7
n/a gougucms 4.08.8
n/a gougucms 4.08.9
n/a gougucms 4.08.10
n/a gougucms 4.08.11
n/a gougucms 4.08.12
n/a gougucms 4.08.13
n/a gougucms 4.08.14
n/a gougucms 4.08.15
n/a gougucms 4.08.16
n/a gougucms 4.08.17
n/a gougucms 4.08.18

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in GouguCMS version 4.08.18. An authenticated administrator can inject malicious HTML or JavaScript code via the title parameter in the user level management function. The input is stored in the database without proper validation or sanitization and later rendered unsafely in user-level and user list pages, allowing arbitrary scripts to execute in users' browsers.

Detection Guidance

Check if your GouguCMS version is 4.08.18 or earlier. Inspect network traffic for POST requests to /admin/level/add with a title parameter containing HTML or JavaScript payloads. Look for stored XSS indicators like <script> tags in user-level or user list pages.

Impact Analysis

If exploited, this vulnerability could allow attackers to steal session cookies, perform actions on behalf of users, or deface web pages. Users viewing affected pages may have their browsers compromised, leading to data theft or unauthorized access to their accounts. The impact is limited to users accessing the compromised pages.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive user data through XSS attacks. GDPR requires protection against unauthorized data access, while HIPAA mandates safeguards for protected health information. A successful exploit may result in data breaches, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Upgrade GouguCMS to the latest version if available. Implement input validation to reject HTML/JS in the title parameter. Apply output encoding when displaying stored values. Restrict access to the /admin/level/add endpoint to trusted administrators only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116100. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart