Quick answers
- Is CVE-2026-116623 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116623 being exploited in the wild.
- How severe is CVE-2026-116623?
- High severity, with a CVSS score of 7.3, published 27 October 2026.
- Which products and versions are affected?
- Code-Projects Simple Content Management System 1.0.
- Is there a fix for CVE-2026-116623?
- No fixed version is recorded yet. Add session validation at the top of every administrative page: invoke session_start() and check if $_SESSION['user'] is set before rendering any admin functionality; redirect to login.php if the session is invalid or missing. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-116623 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-116623?
- Check whether you run Code-Projects Simple Content Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Add session validation at the top of every administrative page: invoke session_start() and check if $_SESSION['user'] is set before rendering any admin functionality; redirect to login.php if the session is invalid or missing.
Technical details
Missing authorization in /web/admin/welcome.php and /web/admin/addnews.php allows unauthenticated remote access to administrative functionality. The vulnerable component performs no session_start() or session validation before rendering the admin panel, making the login mechanism in login.php completely optional. An attacker can directly access the admin interface and manipulate the addnews parameter to create content without any authentication.
Affected products
- code-projects Simple Content Management System 1.0
Timeline
- 2026-10-27: disclosed