EUVD-2026-109585
GHSA-9wwg-c5q6-j74r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain admin access to gougucms panel
-
DeliverySubmit crafted Title in User Level Add
-
ExploitPayload stored by Level.php handler
-
ExecutionAnother admin views the page
-
ImpactScript executes in victim's browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires authenticated access at administrator privilege level (PR:H) to the gougucms admin panel, specifically the User Level Handler's Add function in app/admin/controller/Level.php, where the Title argument is not sanitized. A second user must then view the affected admin page for the stored script to execute (UI:P / passive user interaction). Limiting factors: back-office admin authentication is required so this is not anonymously exploitable despite the network vector; impact is confined to the admin interface; and the product's small deployment footprint further narrows real-world exposure. No vendor fix is available, so removing exposure depends on restricting admin access until a patch exists. |
| Impact | Signals point to a low-priority issue despite the XSS classification. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N, score 4.8) requires high privileges (PR:H) - i.e. an already-authenticated administrator - because the affected code path is in app/admin/controller/Level.php, the admin-side User Level handler. This heavily limits real-world impact: an actor who can reach the Add function already holds admin rights, so the stored XSS largely amounts to script injection that could affect other back-office users via UI:P. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation. A public PoC reference exists (GitHub writeup) but it is not verified as working exploit code, and the vuln.today decision label is 'this_month' (not act_now/emergency), consistent with moderate, non-urgent priority. Conflict to flag: the vector is AV:N (network) yet PR:H means it is only reachable by privileged admin users - this is an authenticated back-office flaw, not an anonymous internet-facing one, so treat the 'remote' framing with that caveat. |
| Exploit ScenarioDerived | An authenticated administrator (or an attacker who has compromised an admin account) opens the User Level Add function and submits a crafted Title value containing an XSS payload. The payload is stored and later rendered in the admin interface, executing in the browser of another back-office user who views the level listing. A public PoC reference exists; it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Stored cross-site scripting in gougucms affects releases up to and including 4.08.18, specifically the Add function in app/admin/controller/Level.php where the Title argument of a User Level record is not sanitized before being stored and later rendered. Exploitation requires authenticated access at administrator privilege level (PR:H) to the back-office panel, plus a second user viewing the affected admin page for the script to run (UI:P), so this is not anonymously reachable despite the network vector; impact is confined to the admin interface. A public PoC reference exists (GitHub write-up linked from the VulDB entry); it is not verified as working exploit code, there is no CISA KEV listing, and the vendor did not respond to the disclosure, so no fixed release is identified.
RemediationAI
No vendor-released patch is identified at time of analysis: the maintainer was contacted ahead of publication and did not respond, and none of the references point to a fixed version, commit, or tag, so the only confirmed course is to remove exposure by restricting access to the gougucms admin panel. Put the back office behind network controls, such as an IP allowlist, an authenticated reverse proxy, or a VPN, so only trusted administrator workstations can reach app/admin/*; the trade-off is that legitimate remote administration must route through the same tunnel. Tighten who can create or edit User Level records, since the flaw needs admin-level (PR:H) access, and audit existing level titles for injected markup before and after the restriction is in place. If a WAF or reverse proxy inspection layer is available, deploy rules that reject script or event-handler payloads in admin POST parameters and in responses from the user level screens, accepting the usual false-positive and maintenance cost of signature tuning. Until an upstream fix appears, treat administrator sessions as the exposed surface and avoid browsing untrusted level records with a privileged session; re-check the VulDB record at https://vuldb.com/vuln/426168 for a patched release before relaxing these controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
gougucms is a PHP-based content management system whose administrative back end lives under app/admin/controller; the affected handler is the Level controller, which manages user level (role/group) definitions. The Add action accepts a Title argument that is persisted and later emitted into admin HTML without output encoding or input validation, the classic CWE-79 cross-site scripting pattern (improper neutralization of user-controllable data placed in a web page). Because the payload is stored rather than reflected, the malicious Title is re-served whenever an administrator browses the user level listing, executing in that administrator's browser session. Per the assessed vector, the attacker must already hold high-privileged admin credentials (PR:H), and a victim user must passively interact with the affected page (UI:P), which bounds both reach and consequence; the supplied sources do not describe the exact rendering sink or template that emits the Title. The CVSS 4.0 vector carries E:P, matching the existence of a public proof-of-concept reference rather than confirmed exploitation. The affected CPE (cpe:2.3:a:n/a:gougucms:*:*:*:*:*:*:*:*) is version-wildcarded, with the advisory scoping impact to versions through 4.08.18.
Know when Gougucms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Reachable only via the admin-side Add function, so PR:H; stored XSS executes in a victim's browser (UI:R, S:C) with limited C/I and no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in gougucms up to 4.08.18. Impacted is the function Add of the file app/admin/controller/Level.php of the component User Level Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
gougucms v4.08.18 was discovered to contain a password reset poisoning vulnerability which allows attackers to arbitrari
A stored cross-site scripting (XSS) vulnerability in /home/user/edit_submit of gougucms v4.08.18 allows attackers to exe
A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. Ra
Authenticated remote code execution via mass assignment in GougoCMS 4.08.18 User Registration Handler allows attackers w
Stored cross-site scripting (XSS) in GouguCMS 4.08.18 allows authenticated remote attackers to inject malicious scripts
Exploit-DB