CVE-2026-5248
Medium · 6.3CVSS
6.3
EPSS
0.4%
Published
Apr 1, 2026
CISA due date
—
The record
A vulnerability has been found in gougucms 4.08.18. This affects the function reg_submit of the file gougucms-master\app\home\controller\Login.php of the component User Registration Handler. Such manipulation of the argument level leads to dynamically-determined object attributes. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-92953 vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer… CWE-913
- CVE-2026-92955 vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers… CWE-913
- CVE-2026-92946 vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is… CWE-913
- CVE-2026-92935 vm2 is a sandbox for running untrusted Node.js code. CWE-913
- CVE-2026-65181 Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with… CWE-913
- CVE-2026-41870 Missing Authorization, Improper Control of Generation of Code ('Code Injection')… CWE-913
- CVE-2026-84430 A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. CWE-913
- CVE-2026-59283 Applications that evaluate Spring Expression Language (SpEL) expressions using… CWE-913