CVE-2026-108566
lowA vulnerability has been found in InstantSoft icms2 up to 2.18.2.
A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3a1ec8fcb073a46d06a2ab83bc2bf68225834281. It is best practice to apply a patch to resolve this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/instantsoft/icms2/ cna@vuldb.com
- https://github.com/instantsoft/icms2/commit/3a1ec8fcb073a46d06a2ab83bc2bf68225834281 cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-108566 cna@vuldb.com
- https://vuldb.com/submit/954247 cna@vuldb.com
- https://vuldb.com/vuln/416223 cna@vuldb.com
- https://vuldb.com/vuln/416223/cti cna@vuldb.com
- https://vuldb.com/submit/954247 134c704f-9b21-4f2e-91b3-4a467353bcc0