{"id":"CVE-2026-52307","title":"An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field.","summary":"An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field.","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"published":"2026-09-08","updated":"2026-09-14","sourceUpdated":"2026-09-14T14:17:07.820","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52307","references":[{"url":"http://classcms.com","label":"cve@mitre.org"},{"url":"https://github.com/linan-OO/CVE-2026-52307","label":"cve@mitre.org"},{"url":"http://seclists.org/fulldisclosure/2026/Sep/31","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org","exploit-available"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T13:28:22.364036Z"},"epss":0.00266,"epssPercentile":0.1877,"exploits":{"github":1,"githubRepos":["https://github.com/linan-OO/CVE-2026-52307"],"checkedAt":"2026-09-21T15:29:23.835Z"},"exploitAvailable":true,"ingestedAt":"2026-09-08T17:06:31.888Z","slug":"CVE-2026-52307","body":"## Overview\n\nAn authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201738,"id":"CVE-2026-52307","ts":1789399664506,"field":"cvss","old":null,"new":"5.4"},{"seq":201737,"id":"CVE-2026-52307","ts":1789399664506,"field":"severity","old":"none","new":"medium"},{"seq":200468,"id":"CVE-2026-52307","ts":1789397301952,"field":"cvss","old":"5.4","new":null},{"seq":200467,"id":"CVE-2026-52307","ts":1789397301952,"field":"severity","old":"medium","new":"none"},{"seq":200099,"id":"CVE-2026-52307","ts":1789395646910,"field":"cvss","old":null,"new":"5.4"},{"seq":200098,"id":"CVE-2026-52307","ts":1789395646910,"field":"severity","old":"none","new":"medium"}]}