CVE-2026-88746

HighCVSS 7.1

Published: 21/09/2026(UTC)Updated: 22/09/2026(UTC)Translated: 22/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.

Risk Assessment

An attacker can inject a malicious script that executes in the administrator's browser, potentially leading to session theft or account takeover. However, administrator interaction is required.

Recommendation

Update idccms to a version newer than V1.70 or apply the vendor patch. Implement input validation and sanitization in /admin/makeDiy_deal.php.

Other vulnerabilities in idccms

CVE-2026-108815Low
A vulnerability has been found in idcCMS 1.70. It affects an unknown function of the file admin/member_deal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Original NVD description (English source)

idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS