light0011 CMS EUVD-2026-104012

Exploitation requires the light0011 cms application to be deployed and network-reachable with the Vote Handler endpoint active; the attacker crafts an HTTP request to App/Home/Controller/VoteController.class.php with a manipulated (forged, altered, or omitted) X-Requested-With header to defeat the application's AJAX-request detection and induce business-logic errors. Per the CVSS vector (PR:N/UI:N/AC:L/AT:N), no authentication, no user interaction, and no special configuration are required - this is exploitable against the default deployment. The practical LIMITING factor is not technical difficulty but blast radius: impact is confined to low integrity/availability effects on vote handling (VC:N), and the product's rarity means few real targets exist.

This is a low-to-moderate priority issue despite being remotely exploitable without authentication. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-based, low-complexity, unauthenticated exploitation with no user interaction, which raises exposure; however, the impact metrics are deliberately limited to VC:N/VI:L/VA:L (no confidentiality impact, only low integrity and low availability impact), consistent with a business-logic flaw (CWE-840) rather than code execution or data theft. The E:P (Proof-of-Concept) temporal signal and the 'Publicly available' POC indicator agree that exploit code exists, but this is a single-source finding reported by VulDB with the POC being nothing more than a public GitHub issue report - publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. No EPSS probability was supplied, so automated-exploitation likelihood cannot be quantified; given the obscurity of the product, real-world targeting is almost certainly negligible. The input Tags label this 'Information Disclosure,' which conflicts with both the description ('business logic errors') and the CVSS confidentiality metric (VC:N) - that tag appears mislabeled and should not drive confidentiality-based prioritization.

A remote, unauthenticated attacker sends a crafted HTTP request to the Vote Handler (VoteController.class.php) with a manipulated X-Requested-With header, which the application uses to distinguish AJAX requests from normal ones. By forging or omitting this header, the attacker subverts the handler's intended control flow to produce business-logic errors - for example, manipulating or replaying vote operations. A public proof-of-concept exists in the form of the project's GitHub issue report, so the technique is documented and reproducible.