CVE-2026-36521: XSS
PublicCMS V5.202506.d has a Cross Site Scripting (XSS) vulnerability in the site configuration management module.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If the site configuration management module is not required, disable/unload the module in PublicCMS to remove exposure to the XSS vulnerability.
PublicCMS (site configuration management module) enabled = false - Compensating control
If the module must remain enabled, restrict access to the site configuration management functionality to trusted administrative IPs and/or place a Web Application Firewall (WAF) in front of the application to block common XSS payloads until an official fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-36521?
The severity of CVE-2026-36521 is rated as medium with a CVSS score of 6.1.
What type of vulnerability is CVE-2026-36521?
CVE-2026-36521 is classified as a Cross Site Scripting (XSS) vulnerability.
How do I fix CVE-2026-36521?
To fix CVE-2026-36521, ensure proper input validation and encoding for the site configuration management module.
Which software is affected by CVE-2026-36521?
CVE-2026-36521 affects PublicCMS V5.202506.d.
When was CVE-2026-36521 published?
CVE-2026-36521 was published on June 15, 2026.