CVE-2026-116100: gougucms User Level Level.php add cross site scripting
A vulnerability has been found in gougucms up to 4.08.18. Impacted is the function Add of the file app/admin/controller/Level.php of the component User Level Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs high privileges and user interaction to exploit the cross-site scripting flaw. The attack can be performed remotely.
Which installations are affected?
gougucms versions up to 4.08.18 are identified as affected. The issue is in the User Level Handler's Add function in app/admin/controller/Level.php, where the Title argument is not safely handled.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
Has the vendor provided a response or fix?
The available information states that the vendor was contacted early about the disclosure but did not respond. No fixed version or vendor mitigation is provided.