CVE-2026-96739

MediumCVSS 4.3/10Last modified Sep 24, 2026

Description

A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/upload_json.php of the component KindEditor Upload Interface. This manipulation of the argument imgFile causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Sep 24, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-96744.3A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume fail CVE-2026-967406.5A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are co CVE-2026-967436.4The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versio CVE-2026-967447.1Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can CVE-2026-967455.6Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document con CVE-2026-967466.5An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resol CVE-2026-967475.0The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a CVE-2026-967486.5PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimite CVE-2026-967498.4An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single CVE-2026-96757.5Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed me CVE-2026-967507.1MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the CVE-2026-967517.3A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the func