Threat database

A stored cross-site scripting (XSS) vulnerability exists in vincent-peugnet wcms through version 3.18.0. Unauthenticated attackers can inject malicious scripts via the login user field and visitor comment website field. These scripts execute with administrator or editor privileges when rendered in specific admin interfaces such as adminlog.php and editrightbar.php.

CVE-2026-105123 is a high-severity remote code execution vulnerability in vincent-peugnet wcms up to version 3.18.0. Authenticated editors can upload arbitrary files, including .php scripts, by exploiting an unvalidated file path in the media upload API. This allows attackers to execute code on the server, write files outside the intended media directory using encoded path traversal sequences, and delete arbitrary files via the media deletion API.