Is there a public PoC exploit available for CVE-2026-6184?

Yes, a public proof-of-concept exploit is available for CVE-2026-6184. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6184

Q: What is the CVSS score of CVE-2026-6184?

CVE-2026-6184 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21982 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-13 VulDB

PHP XSS Simple Content Management System Code Projects

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 13, 2026 - 16:22 NVD

LOW MEDIUM

CVSS changed

Apr 13, 2026 - 16:22 NVD

2.4 (LOW) 4.8 (MEDIUM)

Analysis Generated

Apr 13, 2026 - 16:12 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 15:45 euvd

EUVD-2026-21982

Analysis Generated

Apr 13, 2026 - 15:45 vuln.today

CVE Published

Apr 13, 2026 - 15:00 nvd

LOW 1.9

DescriptionCVE.org

A weakness has been identified in code-projects Simple Content Management System 1.0. This affects an unknown part of the file /web/admin/welcome.php. Executing a manipulation of the argument News Title can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Stored cross-site scripting (XSS) in code-projects Simple Content Management System 1.0 allows authenticated high-privilege attackers to inject malicious scripts via the News Title parameter in /web/admin/welcome.php, affecting all versions of the product. The vulnerability requires user interaction (UI:R) to execute but has publicly available exploit code and a low CVSS score (2.4) due to high privilege requirements and limited impact scope.

Technical ContextAI

This is a stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) in a PHP-based content management system. The /web/admin/welcome.php file fails to properly sanitize or encode user input from the News Title parameter before storing it in a backend system and rendering it in web pages. When an authenticated administrator submits a crafted News Title containing JavaScript or HTML markup, the payload is stored persistently and executed in the context of other users' browsers without proper output encoding. The vulnerability affects the Simple Content Management System product (CPE: cpe:2.3:a:code-projects:simple_content_management_system:*:*:*:*:*:*:*:*), indicating all versions may be impacted.

RemediationAI

Upgrade to a patched version of code-projects Simple Content Management System if available from the vendor at https://code-projects.org/. As an interim mitigation, restrict access to /web/admin/welcome.php to trusted administrators only and implement input validation to reject or encode special characters (< > " ' &) in the News Title field before storage. Additionally, enforce output encoding (HTML entity encoding) when the News Title is rendered in web pages to prevent script execution. Web application firewalls can be configured to detect and block stored XSS payloads in the News Title parameter. Consult the vendor advisory and the public exploit at https://github.com/Xmyronn/simple-cms-stored-xss-news-title for additional technical details on the attack vector.