CVE-2026-108566

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-108566

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108566.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-108566

Published

2026-10-11T09:15:16Z

Modified

2026-10-13T02:46:24Z

Severity

2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

InstantSoft icms2 Private Message index.tpl.php index cross site scripting

Details

A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3a1ec8fcb073a46d06a2ab83bc2bf68225834281. It is best practice to apply a patch to resolve this issue.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108566.json"
}

References

Affected packages

Git / github.com/instantsoft/icms2

Affected ranges

Type

GIT

Repo

https://github.com/instantsoft/icms2

Events

Introduced

7331eb52a22deb277baebd6fb7dd7b2179b27e90

Fixed

3a1ec8fcb073a46d06a2ab83bc2bf68225834281

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "2.18.0"
        },
        {
            "last_affected":  "2.18.0"
        },
        {
            "introduced":  "2.18.1"
        },
        {
            "last_affected":  "2.18.1"
        },
        {
            "introduced":  "2.18.2"
        },
        {
            "last_affected":  "2.18.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*

2.18.0

2.18.1

2.18.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108566.json"