CVE-2026-85382
Received Received - Intake

Cross-Site Scripting in light0011 CMS Chapter Content Output

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulDB

Description
A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialchars_decode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the component Chapter Content Output. Performing a manipulation of the argument content results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85382
EUVD
EUVD-2026-70855

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
light0011 cms *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in a CMS application where article content is rendered without proper encoding. The issue allows malicious script-capable markup to execute when users view the affected article, enabling attackers to run JavaScript in the context of readers' browsers.

Detection Guidance

Check for suspicious article content in the CMS database or template files. Look for payloads like <svg/onload=...> in the Chapter Content Output section. Review HTTP POST requests to the chapter administration interface for unusual inputs.

Impact Analysis

This vulnerability can lead to session theft, content manipulation, phishing attacks, or actions performed on behalf of victims. Attackers can inject malicious payloads via crafted requests, which execute when the article is viewed by other users.

Compliance Impact

This vulnerability enables stored Cross-Site Scripting (XSS), allowing attackers to inject malicious scripts into article content. If exploited, it could lead to unauthorized data access, session hijacking, or phishing attacks, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information by exposing sensitive user data or enabling unauthorized actions.

Mitigation Strategies

Implement server-side HTML allowlisting to sanitize article content before storage or output. Remove or replace the use of htmlspecialchars_decode() in the template file oneChapter.tpl. Ensure all user inputs are treated as untrusted and properly encoded.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85382. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart