Description
u5CMS through v12.8.8 is vulnerable to reflected XSS via the ‘thanks’ parameter in multiple form components
Published: 2026-07-02
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is a reflected cross‑site scripting vulnerability in u5CMS versions up to 12.8.8 that arises from unsanitized handling of the “thanks” parameter in multiple form components. The input is reflected back into the resulting HTML, allowing an attacker to embed arbitrary JavaScript code that classified as CWE‑79, Improper Neutralization of Input During Web Page Generation.

Affected Systems

u5CMS content management systems built with versions 12.8.8 and earlier are affected. The CVE does not specify an official fix, but users should verify whether a recent release contains remediation.

Risk and Exploitability

The CVSS score of 6.4 places the vulnerability in the Medium severity range. The EPSS score is below 1%, indicating a very low vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted POST request to any public form that includes the “thanks” field. Based on the description, it is inferred that a victim must load the reflected page in their browser for execution to occur, so user interaction is required.

Generated by OpenCVE AI on August 1, 2026 at 21:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check the vendor's website for any available patch; update u5CMS to the latest released version if a fix is available.
  • If upgrading is not immediately possible, block or sanitize the ‘thanks’ parameter on form submissions using WAF rules or server‑side validation output encoding for any data reflected in the page to prevent injection of malicious scripts.
  • Consider implementing a Content Security Policy (CSP) that disallows inline scripts to reduce impact if an XSS payload bypasses input sanitization.

Generated by OpenCVE AI on August 1, 2026 at 21:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared U5cms
U5cms u5cms
Vendors & Products U5cms
U5cms u5cms

Thu, 02 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Description u5CMS through v12.8.8 is vulnerable to reflected XSS via the ‘thanks’ parameter in multiple form components
Title POST-based reflected XSS via the thanks parameter in form components
References
Metrics cvssV4_0

{'score': 6.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H'}

Subscriptions

U5cms U5cms
cve-icon MITRE

Status: PUBLISHED

Assigner: NCSC.ch

Published:

Updated: 2026-07-02T13:14:25.969Z

Reserved: 2026-07-02T07:19:55.068Z

Link: CVE-2026-14449

cve-icon Vulnrichment

Updated: 2026-07-02T13:14:22.840Z

cve-icon NVD

Status : Deferred

Published: 2026-07-02T12:16:55.580

Modified: 2026-07-02T17:42:23.640

Link: CVE-2026-14449

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T21:30:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')