https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 12 Sep 2026 11:23:42 +0000 https://vulnerability.circl.lu/sighting/f2b2a232-120a-4d80-b478-c8ccf7ea9d95/export {"uuid": "f2b2a232-120a-4d80-b478-c8ccf7ea9d95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78834", "type": "seen", "source": "https://gist.github.com/AEQ3/574cb644306776a9ff1a0de30b085e62", "content": "**CVE ID:** CVE-2026-78834\n\n**Title:** CMSimple 5.22 CoAuthors Plugin Remote Server-Side Code Execution\n\n**Vendor:** CMSimple (https://www.cmsimple.org/)\n\n**Affected Product:** CMSimple 5.22\n\n**Affected Component:** CoAuthors plugin, content import functionality, server-side scripting evaluation logic\n\n**Vulnerability Type:** Server-Side Code Execution (Remote)\n\n**Attack Vector:** Remote\nAn authenticated low-privileged user with the ability to modify page content can trigger server-side code execution by utilizing the content import functionality. This is achieved by referencing specially crafted external or uploaded text content, which is then improperly evaluated by the server-side scripting logic.\n\n**Impact:** Successful exploitation allows the attacker to execute arbitrary code on the underlying server, potentially leading to complete compromise of the web server and sensitive data theft.\n\n\n**Reference:** https://github.com/AEQ3/CVE/issues/1\n\n**Suggested Description:**\nA code execution vulnerability exists in CMSimple 5.22 within the CoAuthors plugin. The vulnerability stems from insecure server-side evaluation of imported content, allowing authenticated users to execute arbitrary code.", "creation_timestamp": "2026-09-04T15:48:59.401494Z"} {"uuid": "f2b2a232-120a-4d80-b478-c8ccf7ea9d95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78834", "type": "seen", "source": "https://gist.github.com/AEQ3/574cb644306776a9ff1a0de30b085e62", "content": "**CVE ID:** CVE-2026-78834\n\n**Title:** CMSimple 5.22 CoAuthors Plugin Remote Server-Side Code Execution\n\n**Vendor:** CMSimple (https://www.cmsimple.org/)\n\n**Affected Product:** CMSimple 5.22\n\n**Affected Component:** CoAuthors plugin, content import functionality, server-side scripting evaluation logic\n\n**Vulnerability Type:** Server-Side Code Execution (Remote)\n\n**Attack Vector:** Remote\nAn authenticated low-privileged user with the ability to modify page content can trigger server-side code execution by utilizing the content import functionality. This is achieved by referencing specially crafted external or uploaded text content, which is then improperly evaluated by the server-side scripting logic.\n\n**Impact:** Successful exploitation allows the attacker to execute arbitrary code on the underlying server, potentially leading to complete compromise of the web server and sensitive data theft.\n\n\n**Reference:** https://github.com/AEQ3/CVE/issues/1\n\n**Suggested Description:**\nA code execution vulnerability exists in CMSimple 5.22 within the CoAuthors plugin. The vulnerability stems from insecure server-side evaluation of imported content, allowing authenticated users to execute arbitrary code.", "creation_timestamp": "2026-09-04T15:48:59.401494Z"} https://vulnerability.circl.lu/sighting/f2b2a232-120a-4d80-b478-c8ccf7ea9d95/export Fri, 04 Sep 2026 15:48:59 +0000