CVE-2026-112028: Business Logic Errors in light0011 cms

This vulnerability in light0011 cms involves improper handling of the X-Requested-With argument within the Vote Handler component's VoteController.class.php file. The flaw causes business logic errors that can be remotely exploited. The project was informed early but has not issued a response or patch. Exploit code is publicly available, increasing the risk of exploitation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with limited impact on confidentiality and availability.

Successful exploitation can cause business logic errors in the voting functionality of the CMS, potentially allowing attackers to manipulate vote-related operations remotely. This could affect the integrity of vote processing or related application logic. There is no indication of direct impact on confidentiality or system control beyond the business logic errors described.

No official fix or patch is currently available as the vendor has not responded. Users should monitor the vendor's advisory channels for updates. Until a patch is released, consider implementing application-level controls to validate and sanitize the X-Requested-With header or restrict access to the vulnerable Vote Handler functionality if possible.