Simple Content Management System (1.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/simple-content-management-system-1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 01:52:30 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgcode-projects Simple Content Management System: Missing Authorization (CVE-2026-116623)https://feed.craftedsignal.io/briefs/2026-10-simple-cms-auth-bypass/Tue, 27 Oct 2026 01:52:30 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-simple-cms-auth-bypass/An authorization bypass vulnerability in the Admin Interface of code-projects Simple Content Management System 1.0 allows remote attackers to manipulate the addnews argument to perform unauthorized actions.CVE-2026-116623 describes a missing authorization vulnerability in code-projects Simple Content Management System version 1.0. The vulnerability resides in '/web/admin/welcome.php' within the Admin Interface component. Attackers can remotely exploit this by manipulating the 'addnews' argument. Public exploit code is available for this vulnerability.

Impact

Successful exploitation allows for unauthorized manipulation of administrative functions, specifically regarding the addition of content within the CMS, potentially leading to unauthorized data entry or administrative control depending on the context of the affected function.

Recommendation

  • Inventory all instances of code-projects Simple Content Management System in the environment.
  • Prioritize restricting access to the '/web/admin/' directory via web server configuration to trusted management IPs.
  • Monitor web server access logs for anomalous POST or GET requests targeting '/web/admin/welcome.php' containing the 'addnews' parameter.
]]>highadvisoryweb-vulnerabilitycmsauthorization-bypass