CVE-2026-108815: idcCMS member_deal.php cross site scripting
A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/memberdeal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Deployments of idcCMS 1.70 with the admin/member_deal.php endpoint reachable by an attacker are exposed. Exploitation also requires a logged-in account with the necessary privileges and user interaction with the injected content.
What could an attacker do if exploitation succeeds?
The issue can enable cross-site scripting, allowing attacker-supplied script to run in a victim's browser in the affected application's context. The provided scoring indicates integrity impact, with no stated confidentiality or availability impact.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.