CVE-2026-116623
code-projects Simple Content Management System Admin welcome.php authorization
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 27, 2026
- Updated
- Oct 27, 2026
- Reserved
- Oct 26, 2026
Description
A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Simple Content Management Systemcode-projects |
|
References
- VDB-426553 | code-projects Simple Content Management System Admin welcome.php authorizationvdb-entrytechnical-description
- VDB-426553 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-116623 | CVE Analysis and Reportthird-party-advisory
- Submit #1024407 | code-projects Simple Content Management System 1.0 Missing Authorizationthird-party-advisory
- https://github.com/YoonSunWoo02/CVE-simple-cms-broken-access-controlexploit
- https://code-projects.org/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.