CVE-2026-6648

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in Qibo CMS 1.0. Affected by this vulnerability is an unknown functionality of the component Internal Message Module. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Apr 20, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-664805.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Ret CVE-2026-664816.8Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.CVE-2026-664829.8Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.CVE-2026-664839.8Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.CVE-2026-664844.6GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode CVE-2026-664854.6GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocat CVE-2026-664864.6GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members CVE-2026-664885.3Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2 CVE-2026-664895.3Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2 CVE-2026-66496.3A vulnerability was determined in Qibo CMS 1.0. Affected by this issue is some unknown functionality of the file /index/image/headers. Execu CVE-2026-664906.1Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2 CVE-2026-664918.2Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function le