CVE-2026-116623
A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/w
CVSS
7.3
Alta
EPSS
0.4%
p33
KEV
—
Exploit Today
10
0-100
Publicado: 27 de out. de 2026 · Última mod.: 31 de out. de 2026 · CWE-862 · CWE-863
0.4%EPSS · 30 dias0.4%
2026-10-272026-11-07
A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used.
- code-projects.orghttps://code-projects.org/
- github.comhttps://github.com/YoonSunWoo02/CVE-simple-cms-broken-access-control
- vuldb.comhttps://vuldb.com/cve/CVE-2026-116623
- vuldb.comhttps://vuldb.com/submit/1024407
- vuldb.comhttps://vuldb.com/vuln/426553
- vuldb.comhttps://vuldb.com/vuln/426553/cti
- github.comhttps://github.com/YoonSunWoo02/CVE-simple-cms-broken-access-control
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1235275.4 MÉD—
———Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets.12hCVE-2026-1235245.7 MÉD—
———Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators with write access to read tasks from inaccessible projects by registering webhooks. Because webhook payloads are built with the triggering user's permissions, attackers receive related_tasks titles, descriptions and metadata from private projects whenever another user modifies a linked task.12hCVE-2026-1235065.4 MÉD—
———Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects, and read, change or delete existing user webhooks.12hCVE-2026-1242585.3 MÉD—
——0Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.1.19hCVE-2026-1234615.3 MÉD—
——0Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.6.19hCVE-2026-1208366.5 MÉD—
——0Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.3.19h