CVE-2026-1953

Nukegraphic CMS v3.1.2 contains a stored cross-site scripting (XSS) vulnerability in the user profile edit functionality at /ngc-cms/user-edit-profile.php. The application fails to properly sanitize user input in the name field before storing it in the database and rendering it across multiple CMS pages. An authenticated attacker with low privileges can inject malicious JavaScript payloads through the profile edit request, which are then executed site-wide whenever the affected user's name is displayed. This allows the attacker to execute arbitrary JavaScript in the context of other users' sessions, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of victims.

• CWE-79

• https://github.com/carlosbudiman/CVE-2026-1953-Disclosure

Published

Feb 5, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19515The WSO2 Integrator MI VS Code extension fails to properly s…7
• CVE-2026-19516A caller-supplied X-Grafana-URL request header controls the …9.1
• CVE-2026-19517Improper Validation of Specified Quantity in Input and Alloc…6.5
• CVE-2026-19518Improper Validation of Specified Quantity in Input vulnerabi…6.5
• CVE-2026-19519A flaw was found in claircore's RPM package scanner. Crafted…4.3
• CVE-2026-1952Delta Electronics AS320T has denial of service via the undoc…7.5
• CVE-2026-19532Improper Limitation of a Pathname to a Restricted Directory …5.3
• CVE-2026-19534undici's WebSocket client crashes the whole Node.js process …7.5
• CVE-2026-19535Nozomi Networks Labs identified a CWE-352: Cross-Site Reques…8.6
• CVE-2026-19538The BLOCKED access control list items that are evaluated to …7.5
• CVE-2026-19539Authorization Bypass Through User-Controlled Key in the tick…8.6
• CVE-2026-19542Calling tdelete on a sufficiently deep tree in the GNU C Lib…5.6