CVE-2026-112028: light0011 cms Vote VoteController.class.php logic error
A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.class.php of the component Vote Handler. This manipulation of the argument X-Requested-With causes business logic errors. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
The issue can be exploited remotely and does not require privileges or user interaction. Exploitation involves manipulating the X-Requested-With request argument sent to the Vote Handler.
What is the likely impact of successful exploitation?
Successful exploitation can cause business logic errors in the Vote Handler. The reported severity vector indicates low integrity and availability impact, with no reported confidentiality impact.
Is public exploit code available?
Yes. An exploit has been published and may be used.
Is a vendor fix or response available?
The project was notified through an issue report but had not responded at the time of publication. No fix or workaround is identified in the provided information.