Cross Site Scripting vulnerability in PublicCMS by PublicCMS Inc.
CVE-2026-36521

6.1MEDIUM

Key Information:

Vendor

PublicCMS Inc.

Status
PublicCMS
Vendor
CVE Published:
15 June 2026

What is CVE-2026-36521?

PublicCMS V5.202506.d contains a vulnerability within its site configuration management module, allowing attackers to execute arbitrary scripts in the context of a user's browser session. This XSS vulnerability could be exploited to manipulate user interactions or gather sensitive information, leading to a significant privacy risk for users of the affected version.

References

https://gist.github.com/xiaobai2207/f4f9d0c1a354a368cf5bc...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.