CVE-2026-108566

medium

Description

A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3a1ec8fcb073a46d06a2ab83bc2bf68225834281. It is best practice to apply a patch to resolve this issue.

References

https://vuldb.com/vuln/416223/cti

https://vuldb.com/vuln/416223

https://vuldb.com/submit/954247

https://vuldb.com/cve/CVE-2026-108566

https://github.com/instantsoft/icms2/commit/3a1ec8fcb073a46d06a2ab83bc2bf68225834281

https://github.com/instantsoft/icms2/

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-96869

Details

Source: Mitre, NVD

Published: 2026-10-11

Updated: 2026-10-11

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 3.5

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Severity: Low

CVSS v4

Base Score: 5.1

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00348