EUVD-2026-41325
GHSA-5vjc-525r-rgvh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible reflected XSS requiring no privileges but mandatory user interaction; scope changes to browser context yields low C/I impact with no server-side availability effect.
Primary rating from Vendor (ncsc).
CVSS VectorVendor: ncsc
Lifecycle Timeline
1DescriptionCVE.org
u5CMS through v12.8.8 is vulnerable to reflected XSS via the ‘thanks’ parameter in multiple form components
AnalysisAI
Reflected XSS in u5CMS through v12.8.8 allows unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers via the unsanitized 'thanks' parameter exposed across multiple form components. When a victim user is socially engineered into visiting a crafted URL, injected scripts execute in the application's browser context, with the CVSS 4.0 vector indicating high subsequent-system impact (SC:H/SI:H/SA:H) - consistent with session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit identified at time of analysis; fix is available in v12.8.9.
Technical ContextAI
u5CMS is a PHP-based content management system. The vulnerable 'thanks' parameter appears in multiple form-handling components, likely used as a post-submission redirect target or confirmation message - a common pattern where user-supplied input is reflected directly into the HTTP response. The absence of output encoding on this parameter allows attacker-controlled HTML and JavaScript to be rendered by the victim's browser. CWE classification was not assigned in the source data, though reflected XSS (CWE-79: Improper Neutralization of Input During Web Page Generation) is strongly implied by the description and the 'XSS' tag. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms network accessibility, low attack complexity, no required privileges, and mandatory active user interaction. The divergence between low vulnerable-system impact (VC:L/VI:L/VA:N) and high subsequent-system impact (SC:H/SI:H/SA:H) correctly models reflected XSS semantics, where the browser - not the server - is the primary damage surface.
RemediationAI
Upgrade to u5CMS v12.8.9 or later, available at https://github.com/u5cms/u5cms/releases/tag/v12.8.9, which resolves the reflected XSS in the 'thanks' parameter across affected form components. If immediate upgrade is not feasible, deploying a Web Application Firewall (WAF) rule to detect and block script-like patterns in the 'thanks' parameter can reduce exploitation risk, though this may generate false positives for legitimate form payloads and requires tuning per deployment. Implementing a strict Content-Security-Policy (CSP) response header that disallows inline script execution (script-src 'self') will substantially reduce the impact of any successful XSS injection, but may require application-level changes if the CMS relies on inline scripts and could break existing functionality. Restricting access to form endpoints to authenticated users only - where the application design permits - would raise the bar for exploitation but is not a standalone fix. Patch to v12.8.9 is the only confirmed resolution.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today