CVE-2026-121929
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0 affecting an unknown function of the file /e/member/mspace/index.php. Manipulation of the spacename argument results in cross site scripting. The attack can be launched remotely, and the exploit has been released publicly and may be used in attacks.
Risk Assessment
A remote attacker can exploit XSS to execute malicious script in a victim's browser, potentially hijacking sessions or stealing data. Public exploit availability increases the risk of active exploitation.
Recommendation
No patch is available — consider restricting access to the affected file or deploying WAF rules filtering the spacename parameter. Monitor vendor communications for updates.
Other vulnerabilities in EmpireCMS
See all- CVE-2025-15423Medium
A vulnerability was found in EmpireSoft EmpireCMS up to 8.0 in the CheckSaveTranFiletype function of the file e/class/connect.php, allowing unrestricted upload. The attack can be launched remotely, and the exploit has been disclosed publicly.
- CVE-2025-15422Medium
A flaw was found in EmpireSoft EmpireCMS up to 8.0 in the egetip function of the file e/class/connect.php in the IP Address Handler component. Manipulation causes protection mechanism failure. The attack can be initiated remotely, and the exploit has been published.
Original NVD description (English source)
A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. Impacted is an unknown function of the file /e/member/mspace/index.php. The manipulation of the argument spacename results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS