CVE-2026-52307: Stored XSS in 1CMS v5.6

[懒-癌-症～ via Fulldisclosure <fulldisclosure () seclists org>]

CVE-2026-52307: 1CMS v5.6 Authenticated Stored XSS Vulnerability


Vulnerability Description
An authenticated stored cross-site scripting (XSS) vulnerability exists in the Column Management component of ClassCMS 
1CMS v5.6. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the title field.


- Vulnerability Type: Cross Site Scripting (XSS)
- Vendor: ClassCMS
- Affected Product: 1CMS v5.6
- Affected Component: Column Management → Article Edit page
- Attack Type: Remote
- Impact: Code Execution (Yes), Information Disclosure (Yes)


Attack Vectors
The vulnerability is remotely exploitable over the network. An authenticated administrator can inject arbitrary 
JavaScript into the article title field via the Column Management → Article Edit page. When other users view the 
article list or detail page containing the malicious title, the injected script executes in their browsers.


- Attack complexity: Low
- Privileges required: Administrator


Affected Versions
1CMS v5.6 (and possibly earlier versions).


Reproduction Steps
1. Download and install 1CMS v5.6 on a local environment (PHP 5.2–8.4 supported).
2. Complete the installation and log in as an administrator.
3. Navigate to the admin dashboard → Column Management → Article Edit.
4. In the title field, inject the following payload:
&nbsp; &nbsp;<script&gt;alert('XSS')</script&gt;
5. Save the article.
6. View the article list or detail page as any user.


Expected Result
The injected JavaScript (alert('XSS')) executes in the browser of any user viewing the affected page, confirming the 
stored XSS vulnerability.


Impact Analysis
- Arbitrary script execution in the victim's browser
- Session hijacking – attackers can steal session cookies
- Information disclosure – sensitive data can be exfiltrated
- Phishing attacks – malicious content can be injected
- Defacement – the CMS appearance can be altered


Remediation
- Upgrade to the latest version of 1CMS if a patch is available
- Implement proper input sanitization and output encoding
- Restrict administrator access to trusted users only
- Consider using Content Security Policy (CSP) headers


CVE ID: CVE-2026-52307
Discovered: 2026-09-03
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/