Executive Summary

CVE-2026-1953 is a stored cross-site scripting (XSS) vulnerability found in Nukegraphic CMS version 3.1.2. It occurs in the user profile edit functionality at the /ngc-cms/user-edit-profile.php page. The vulnerability arises because the application does not properly sanitize user input in the name field before saving it to the database and displaying it on multiple CMS pages.

An authenticated attacker with low privileges can exploit this by injecting malicious JavaScript code through the profile edit request. This malicious code is then executed in the browsers of other users whenever the affected user's name is displayed, allowing the attacker to perform actions such as session hijacking, stealing credentials, or executing unauthorized actions on behalf of other users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious security impacts including the execution of arbitrary JavaScript code in the context of other users' sessions. This can lead to session hijacking, where attackers take over user sessions, credential theft, and unauthorized actions performed on behalf of victims.

Because the malicious script runs site-wide whenever the affected user's name is displayed, it can affect multiple users and potentially compromise the security and integrity of the entire CMS environment.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

I don't know

Useful 0 Not Useful 0