CVE-2026-108566: InstantSoft icms2 Private Message index.tpl.php index cross site scripting
A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3a1ec8fcb073a46d06a2ab83bc2bf68225834281. It is best practice to apply a patch to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InstantSoft icms2to a version that resolves this vulnerability.Patch 3a1ec8fcb073a46d06a2ab83bc2bf68225834281
Event History
Frequently Asked Questions
Which deployments are affected?
InstantSoft icms2 versions up to and including 2.18.2 are affected in the Private Message Handler's message index template.
What does exploitation require?
An attacker needs low-level privileges and can launch the attack remotely by manipulating the nickname argument. Successful exploitation also requires user interaction.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What should be done to remediate the issue?
Apply the patch identified as 3a1ec8fcb073a46d06a2ab83bc2bf68225834281.