Cross-Site Scripting Vulnerability in EmpireSoft EmpireCMS

CVE-2026-121929

What is CVE-2026-121929?

A cross-site scripting (XSS) vulnerability has been identified in EmpireSoft's EmpireCMS up to version 8.0. This security flaw resides in an unknown function within the file /e/member/mspace/index.php, which allows the manipulation of the argument 'spacename.' Attackers can exploit this vulnerability to execute malicious scripts remotely, jeopardizing the confidentiality and integrity of user data. Despite early notifications sent to the vendor regarding this issue, there has been no response from them. Given that exploit techniques are publicly available, the potential for widespread attacks exists, underscoring the urgent need for affected users to review and mitigate the risk associated with this vulnerability.

References