CVE-2026-108815
3.5LowPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79, CWE-94
Impact
Authenticated attackers can inject malicious scripts into admin sessions to tamper with page content. This requires an account with low privileges and an administrative user to interact with the malicious payload.
Root cause
Improper input sanitization or output encoding in admin/member_deal.php allows arbitrary script execution via cross-site scripting.
Affected systems
idcCMS 1.70
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No official patched version is announced; restrict access to admin/member_deal.php or place administrative interfaces behind a VPN/WAF until a vendor patch or custom input sanitization fix is applied.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/member_deal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.