A stored cross‑site scripting flaw resides in the /web/admin/welcome.php file of Simple Content Management System 1.0. By manipulating the News Title argument, an attacker can inject arbitrary JavaScript that executes in the browsers of users who view the affected content. This can lead to session hijacking, defacement, or theft of sensitive information. The weakness is a classic input‑validation error mapped to CWE‑79 and also involves code injection aspects corresponding to CWE‑94. The primary impact is a compromise of confidentiality and integrity for anyone who loads the malicious page.

The vulnerability affects installations of code‑projects Simple Content Management System version 1.0. No specific build or configuration details beyond the presence of the /web/admin/welcome.php page are provided, so any deployment of this version that allows editing of the News Title field is potentially vulnerable.

The CVSS base score is 4.8, indicating a moderate severity. Exploit confidence data (EPSS) is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The description indicates that the exploit is publicly available and can be launched remotely by sending a crafted request that modifies the News Title parameter. Given the mode of exploitation (stored XSS) and the public availability of the exploit code, the risk to affected systems is significant, especially when rendered pages are accessed by untrusted users.