What is the CVSS score of CVE-2026-38931?

CVE-2026-38931 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

simplephp CVE-2026-38931

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 cve@mitre.org

XSS PHP

5.4

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:08 vuln.today

DescriptionCVE.org

A stored cross-site scripting (XSS) vulnerability in the /admin/config-module.php component of creatorsofcode simplephp GitHub commit 5184cff (Latest as of 2026-02-27) via injecting a crafted payload.

AnalysisAI

Stored cross-site scripting in creatorsofcode's simplephp admin panel allows authenticated low-privileged users to inject persistent malicious scripts via the /admin/config-module.php configuration endpoint. When an administrator or privileged user subsequently views the affected page, the stored payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. A proof-of-concept exists per SSVC intelligence; this CVE is not currently listed in CISA KEV.

Technical ContextAI

This is a CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) vulnerability in the PHP-based simplephp web application by creatorsofcode. The affected component is /admin/config-module.php, a configuration management endpoint within the application's admin panel, where user-supplied input is insufficiently sanitized before being persisted and rendered back to users. The CVSS scope modifier is Changed (S:C), indicating the vulnerability crosses security boundaries - a payload injected by a low-privileged user executes within the browser context of a different, potentially higher-privileged user. No CPE strings were provided in the source data; the affected version is confirmed as GitHub commit 5184cff, identified as the latest commit as of 2026-02-27. Tags confirm the technology stack is PHP.

Affected ProductsAI

creatorsofcode simplephp is affected at GitHub commit 5184cff, confirmed as the latest available commit as of 2026-02-27. No CPE strings or explicit version range were provided in the source data - the affected scope beyond this specific commit is not independently confirmed. Vendor project sites are listed as http://creatorsofcode.com and http://simplephp.com. Researcher disclosure is available at https://moworn.github.io/post/cve-2026-38931/.

RemediationAI

No vendor-released patch has been identified at time of analysis. The researcher's public disclosure is documented at https://moworn.github.io/post/cve-2026-38931/ and should be reviewed for any mitigations noted there. As compensating controls, administrators should restrict network access to the /admin/config-module.php endpoint and the broader admin panel to trusted IP addresses or VPN-only access - this directly limits the attacker's ability to submit the crafted payload (trade-off: operational inconvenience for remote admins). Deploying a Content Security Policy (CSP) response header with a strict script-src directive will reduce the impact of any successful XSS injection by blocking inline script execution, though misconfigured CSP can break legitimate admin functionality and requires testing. Input validation and output encoding should be applied at the application level to the config-module.php form fields as a permanent fix when patching. Monitoring admin panel access logs for unexpected low-privileged user activity on configuration endpoints is also advisable.