CVE-2026-6184
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A weakness was identified in code-projects Simple Content Management System 1.0 in an unknown part of /web/admin/welcome.php. Manipulating the News Title argument leads to cross site scripting. The attack can be executed remotely and the exploit is publicly available.
Risk Assessment
XSS may allow execution of malicious script in an administrator's browser, leading to session theft or actions on behalf of the user. The public exploit increases the risk.
Recommendation
Update Simple Content Management System to a patched version or implement input validation and encoding for the News Title field. Consider deploying a Content-Security-Policy header.
Other vulnerabilities in Simple Content Management System
Original NVD description (English source)
A weakness has been identified in code-projects Simple Content Management System 1.0. This affects an unknown part of the file /web/admin/welcome.php. Executing a manipulation of the argument News Title can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS