CVE-2026-108815

LowCVSS 3.5

Published: 12/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

A vulnerability has been found in idcCMS 1.70. It affects an unknown function of the file admin/member_deal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Risk Assessment

An XSS attack can allow injection of malicious scripts into the administrator's browser, leading to session hijacking or data theft. The risk concerns system confidentiality and integrity.

Recommendation

Update idcCMS to the latest version if available. Sanitize input and output in admin/member_deal.php and restrict access to the admin panel.

Other vulnerabilities in idcCMS

CVE-2026-88746High
idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.

Original NVD description (English source)

A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/member_deal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS