gougucms CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM gougucms CVE published 2026-10-26

CVE-2026-116100

A vulnerability was found in gougucms up to 4.08.18, specifically in the User Level Handler of the file app/admin/controller/Level.php. The manipulation of the argument Title leads to cross-site scripting. The attack can be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond.