CVE-2026-1953

Nukegraphic CMS v3.1.2 contains a stored cross-site scripting (XSS) vulnerability in the user profile edit functionality at /ngc-cms/user-edit-profile.php. The application fails to properly sanitize user input in the name field before storing it in the database and rendering it across multiple CMS pages. An authenticated attacker with low privileges can inject malicious JavaScript payloads through the profile edit request, which are then executed site-wide whenever the affected user's name is displayed. This allows the attacker to execute arbitrary JavaScript in the context of other users' sessions, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of victims.

• CWE-79

• https://github.com/carlosbudiman/CVE-2026-1953-Disclosure

Published

Feb 5, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1951Delta Electronics AS320T has no checking of the length of th…9.8
• CVE-2026-19516A caller-supplied X-Grafana-URL request header controls the …9.1
• CVE-2026-19517Improper Validation of Specified Quantity in Input and Alloc…6.5
• CVE-2026-19518Improper Validation of Specified Quantity in Input vulnerabi…6.5
• CVE-2026-19519A flaw was found in claircore's RPM package scanner. Crafted…4.3
• CVE-2026-1952Delta Electronics AS320T has denial of service via the undoc…7.5
• CVE-2026-19539Authorization Bypass Through User-Controlled Key in the tick…8.6
• CVE-2026-19546A flaw was found in DBI. This is a fix for a partial fix for…8.8
• CVE-2026-19550A flaw was found in FreeIPA. The trust-fetch-domains command…4.3
• CVE-2026-19556Use after free in V8 in Google Chrome prior to 151.0.7922.13…8.8
• CVE-2026-19557Use after free in TabStrip in Google Chrome on Mac prior to …8.3
• CVE-2026-19558Use after free in Extensions in Google Chrome prior to 151.0…7.5