Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2026-112028: light0011 CMS VoteController allows remote logic error
CVE-2026-112028 · published today
Summary
The VoteController component in light0011 CMS can be tricked by sending a specially crafted X-Requested-With header, causing it to process requests incorrectly. An attacker on the internet could use this to disrupt voting functions or manipulate outcomes. Apply the vendor's update or disable the affected voting feature until a fix is deployed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| light0011 | cms | c774dce31c6df0055568a8d5c53d964d99be199d |
Original advisory text
light0011 cms Vote VoteController.class.php logic error
A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.class.php of the component Vote Handler. This manipulation of the argument X-Requested-With causes business logic errors. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
5.5
Medium
Type
CWE-840Business Logic Errors
Timeline
Published18 Oct 2026
Updated18 Oct 2026
First seen18 Oct 2026
Track software like this
Free during beta