Simple CMS CVE-2026-116623

The affected function is in /web/admin/welcome.php (Admin Interface) and is triggered by manipulating the 'addnews' argument; per the supplied CVSS 4.0 vector (PR:N/UI:N) the request requires no authentication and no user interaction, so an unauthenticated remote attacker can reach it against a default deployment of code-projects Simple Content Management System 1.0. The primary limiting factor is exposure and footprint rather than configuration: the target application must be network-reachable, and this is a niche hobby/student CMS with minimal production deployment. The description does not state any non-default setting or feature toggle as a precondition, and does not describe the exact trigger beyond manipulation of 'addnews'.

This is a medium-severity (CVSS 4.0 base 5.5) missing-authorization flaw (CWE-862) whose real-world priority is low despite the network-reachable, unauthenticated vector. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates trivial remote reachability with no privileges or user interaction, but all three impact metrics are only Low (VC:L/VI:L/VA:L) and there is no scope/subsequent-system impact (SC:N/SI:N/SA:N), capping the damage. The signals are internally consistent and point to low urgency: EPSS is 0.39% (33rd percentile), the CVE is NOT on CISA KEV, and the maturity flag is E:P (Proof-of-Concept), not functional or active exploitation. The vuln.today decision label is 'this_month,' i.e. patch on a routine cycle rather than emergency. The main caveat is sourcing: the entire record originates from a single reporter (VulDB) for an obscure 'code-projects' hobby/student application, the description does not explain how manipulating the 'addnews' argument bypasses authorization, and the listed GitHub 'exploit' link is a PoC reference not verified as working exploit code. Net: a real but low-priority issue dominated by its tiny deployment footprint, not a high-CVSS-but-overrated-impact case.

A remote, unauthenticated attacker sends a crafted request to /web/admin/welcome.php manipulating the 'addnews' parameter; because the admin function lacks an authorization check, the request is processed as if privileged, letting the attacker add/modify news content in the Admin Interface. A public PoC reference exists but is not verified as working exploit code, and the precise trigger is not described in the available sources. Given AC:L/PR:N/UI:N the request itself is simple, but impact is limited (Low confidentiality/integrity/availability).