CVE-2026-108566

Name of the Vulnerable Software and Affected Versions InstantSoft icms2 versions prior to 2.18.2

Description A remote cross site scripting issue exists within the Private Message Handler component. The problem occurs in the index() function located in the templates/default/controllers/messages/index.tpl.php file. An attacker can exploit this by manipulating the nickname argument to execute malicious scripts in the user's browser.

Recommendations Apply patch 3a1ec8fcb073a46d06a2ab83bc2bf68225834281 to versions prior to 2.18.2.