CVE-2026-9160: CSTI in Arma Digital's Website Template
Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection.
This issue affects Website Template: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What user interaction is required for exploitation?
The CVSS vector indicates that user interaction is required. The available information does not specify what action the user must take.
Can an unauthenticated remote attacker exploit this issue?
The CVSS vector lists network access, low attack complexity, and no privileges required. This indicates exploitation may be attempted remotely without prior authentication, provided the required user interaction occurs.
What is the known impact of a successful exploit?
The reported CVSS impact is limited to integrity, with no confidentiality or availability impact indicated. The description identifies the underlying issue as code injection through improper neutralization of template-engine special elements.
Which releases are identified as affected?
Website Template versions through 11092026 are identified as affected. No fixed version, workaround, or vendor response is provided in the available information.