CVE-2026-52307: n/a

This vulnerability exists in ClassCMS 1CMS v5.6 within the Column Management component. An attacker with authenticated access can inject crafted payloads into the title field, which are then stored and executed in the context of other users, leading to stored XSS. The CVSS 3.1 base score is 5.4 (medium), with network attack vector, low attack complexity, privileges required, and user interaction needed. The impact affects confidentiality and integrity but not availability.

Successful exploitation could allow an authenticated attacker to execute arbitrary web scripts or HTML in the context of other users, potentially leading to data disclosure or manipulation. There is no indication of availability impact. No known exploits are reported in the wild.

No patch or official fix information is provided. Since the vulnerability requires authentication and user interaction, restricting access and monitoring for suspicious activity may reduce risk. Check vendor advisories for updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.