PT-2026-110098

CVE-2026-108566

Published

2026-10-11

Updated

2026-10-13

Description by

CVSS 2.0

4.0

Medium

MetricsAV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions InstantSoft icms2 versions prior to 2.18.2

Description A remote cross site scripting issue exists within the Private Message Handler component. The problem occurs in the index() function located in the templates/default/controllers/messages/index.tpl.php file. An attacker can exploit this by manipulating the nickname argument to execute malicious scripts in the user's browser.

Recommendations Apply patch 3a1ec8fcb073a46d06a2ab83bc2bf68225834281 to versions prior to 2.18.2.

Exploitability

Exploit

Fix

Impacts

Researchers

Evil0Rd

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

CWE-94: Improper Control of Generation of Code (\'Code Injection\')