CVE-2026-32278

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin. Versions 1.41.1 and 2.41.1 contain a patch.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-434CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 23, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-322796.8Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to anCVE-2026-32286.4The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[nxs_fbembed]` shortCVE-2026-322807.5During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed CVE-2026-322817.5Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of pCVE-2026-322826.4On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target oCVE-2026-322837.5If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causingCVE-2026-322847.5The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This CVE-2026-322857.5The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a rCVE-2026-322867.5The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow messagCVE-2026-322877.5Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be trCVE-2026-322885.5tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regionsCVE-2026-322896.1Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when b