CVE-2026-52307 — An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field

Back Back to CVE browser

MEDIUM

An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field

Published Sep 8, 2026

5.4

MEDIUM

CVSS 3.1

EPSS 0.29%

Description

An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.29% 0.00289

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00289

Score over time

Sep–Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (2 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.29% (0.00289)	19.45th	v5 (v2026.06.15)
Sep 9, 2026	0.34% (0.00344)	27.49th	v5 (v2026.06.15)

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

Link	Providers	Tags
http://classcms.com
http://seclists.org/fulldisclosure/2026/Sep/31
https://github.com/linan-OO/CVE-2026-52307

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Sep 8, 2026

Updated Sep 14, 2026

Reserved Jun 8, 2026

Link CVE-2026-52307

CISA Vulnrichment

Updated Sep 14, 2026

NVD

Status Deferred

Modified Sep 14, 2026

Link CVE-2026-52307

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-52307