CVE-2026-38931

Description

A stored cross-site scripting (XSS) vulnerability in the /admin/config-module.php component of creatorsofcode simplephp GitHub commit 5184cff (Latest as of 2026-02-27) via injecting a crafted payload.

References

https://moworn.github.io/post/cve-2026-38931/

http://simplephp.com

http://creatorsofcode.com

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3