CVE-2026-116623

code-projects Simple Content Management System Admin welcome.php authorization

A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used.

Affected

code-projects · Simple Content Management System

CVSS v4.0 VULDB

5.5 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v4.0 VulDB

6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS v3.1 VULDB

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS v3.1 VulDB

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

CVSS v3.0 VulDB

7.3 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

CVSS v2.0 VULDB

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v2.0 VulDB

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

EPSS

0.39% chance of exploitation in the next 30 days, 33rd percentile

Published

2026-10-27

Updated

2026-10-31

Proof-of-concept exploits (1)

• YoonSunWoo02/CVE-simple-cms-broken-access-controlRepo stars 0★ · pushed 2026-10-11 · snapshot
  2 files

  addnews.phpwelcome.php

CVE references

• https://code-projects.orgREFERENCE
• https://vuldb.com/cve/CVE-2026-116623ADVISORY
• https://vuldb.com/submit/1024407ADVISORY
• https://vuldb.com/vuln/426553REFERENCE
• https://vuldb.com/vuln/426553/ctiREFERENCE

References

• CVE Record
• NVD entry