https://vulnerability.circl.lu/sightings/feed 2026-09-12T11:23:36.042248+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/f2b2a232-120a-4d80-b478-c8ccf7ea9d95/export 2026-09-12T11:23:36.068692+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f2b2a232-120a-4d80-b478-c8ccf7ea9d95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78834", "type": "seen", "source": "https://gist.github.com/AEQ3/574cb644306776a9ff1a0de30b085e62", "content": "**CVE ID:** CVE-2026-78834\n\n**Title:** CMSimple 5.22 CoAuthors Plugin Remote Server-Side Code Execution\n\n**Vendor:** CMSimple (https://www.cmsimple.org/)\n\n**Affected Product:** CMSimple 5.22\n\n**Affected Component:** CoAuthors plugin, content import functionality, server-side scripting evaluation logic\n\n**Vulnerability Type:** Server-Side Code Execution (Remote)\n\n**Attack Vector:** Remote\nAn authenticated low-privileged user with the ability to modify page content can trigger server-side code execution by utilizing the content import functionality. This is achieved by referencing specially crafted external or uploaded text content, which is then improperly evaluated by the server-side scripting logic.\n\n**Impact:** Successful exploitation allows the attacker to execute arbitrary code on the underlying server, potentially leading to complete compromise of the web server and sensitive data theft.\n\n\n**Reference:** https://github.com/AEQ3/CVE/issues/1\n\n**Suggested Description:**\nA code execution vulnerability exists in CMSimple 5.22 within the CoAuthors plugin. The vulnerability stems from insecure server-side evaluation of imported content, allowing authenticated users to execute arbitrary code.", "creation_timestamp": "2026-09-04T15:48:59.401494Z"} 2026-09-04T15:48:59.401494+00:00