{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/simple-content-management-system-1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:code-projects:simple_content_management_system:1.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-116623"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Simple Content Management System (1.0)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","cms","authorization-bypass"],"_cs_type":"advisory","_cs_vendors":["code-projects"],"content_html":"\u003cp\u003eCVE-2026-116623 describes a missing authorization vulnerability in code-projects Simple Content Management System version 1.0. The vulnerability resides in '/web/admin/welcome.php' within the Admin Interface component. Attackers can remotely exploit this by manipulating the 'addnews' argument. Public exploit code is available for this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized manipulation of administrative functions, specifically regarding the addition of content within the CMS, potentially leading to unauthorized data entry or administrative control depending on the context of the affected function.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of code-projects Simple Content Management System in the environment.\u003c/li\u003e\n\u003cli\u003ePrioritize restricting access to the '/web/admin/' directory via web server configuration to trusted management IPs.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST or GET requests targeting '/web/admin/welcome.php' containing the 'addnews' parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T01:52:30Z","date_published":"2026-10-27T01:52:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-simple-cms-auth-bypass/","summary":"An authorization bypass vulnerability in the Admin Interface of code-projects Simple Content Management System 1.0 allows remote attackers to manipulate the addnews argument to perform unauthorized actions.","title":"code-projects Simple Content Management System: Missing Authorization (CVE-2026-116623)","url":"https://feed.craftedsignal.io/briefs/2026-10-simple-cms-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Simple Content Management System (1.0)","version":"https://jsonfeed.org/version/1.1"}