This vulnerability affects ClassCMS 1CMS v5.6 in its Column Management component. An authenticated user can exploit a stored XSS flaw by injecting malicious scripts or HTML into the title field, which are then stored and rendered, leading to arbitrary script execution in other users' browsers. The vulnerability requires authentication to exploit. No patch or official fix details have been provided yet.

Successful exploitation allows an authenticated attacker to execute arbitrary scripts in the context of other users, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to users who can view the injected content and requires the attacker to have valid authentication credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users and consider implementing input validation or output encoding on the title field to mitigate stored XSS risks.