Is there a public PoC exploit available for CVE-2026-5249?

Yes, a public proof-of-concept exploit is available for CVE-2026-5249. Prioritise patching immediately. EPSS: 0.0%.

N A CVE-2026-5249

Q: What is the CVSS score of CVE-2026-5249?

CVE-2026-5249 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17769 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-01 VulDB

XSS N A Gougucms

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 01, 2026 - 14:23 vuln.today

Public exploit code

EUVD ID Assigned

Apr 01, 2026 - 01:45 euvd

EUVD-2026-17769

Analysis Generated

Apr 01, 2026 - 01:45 vuln.today

CVE Published

Apr 01, 2026 - 01:30 nvd

MEDIUM 5.1

DescriptionCVE.org

A vulnerability was found in gougucms 4.08.18. This impacts an unknown function of the file \gougucms-master\app\admin\view\user\record.html of the component Record Endpoint. Performing a manipulation of the argument value.content results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stored cross-site scripting (XSS) in GouguCMS 4.08.18 allows authenticated remote attackers to inject malicious scripts via the value.content parameter in the Record Endpoint (\gougucms-master\app\admin\view\user\record.html), which are executed in the context of other users' browsers. The vulnerability has a publicly available exploit and affects user record management functionality with low CVSS score (3.5) due to requirement for user interaction and authenticated access, though the vendor has not responded to disclosure.

Technical ContextAI

This vulnerability exists in GouguCMS, a content management system, specifically in the user record administration endpoint. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a stored XSS flaw where user-supplied input in the value.content parameter is not properly sanitized or encoded before being reflected in HTML output. The affected component is the Record Endpoint file located at \gougucms-master\app\admin\view\user\record.html, which handles user record data without adequate input validation or output encoding. The CPE data indicates the affected product is GouguCMS (cpe:2.3:a:n/a:gougucms) across versions, with specific confirmation of version 4.08.18.

RemediationAI

Immediate remediation requires upgrading GouguCMS to a patched version if available from the vendor; however, no vendor-released patch has been independently confirmed at time of analysis, and the vendor has not responded to disclosure attempts. As interim mitigation, implement strict input validation and output encoding on the value.content parameter in the Record Endpoint, specifically using HTML entity encoding or content security policy (CSP) headers to prevent script execution. Restrict administrative access to trusted networks only and disable the user record feature if not in active use. Monitor for signs of XSS exploitation including unusual administrative actions or session anomalies. Refer to the public disclosure and POC analysis at https://thinhneee.github.io/posts/gougu-blind-xss/ for technical details on the vulnerability mechanics.