Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-29840: JiZhiCMS allows attackers to inject malicious code via user input

CVE-2026-29840 · published 7 months ago

Summary

JiZhiCMS versions 2.5.6 and earlier have a security flaw that allows an attacker to inject malicious code into the system. This could compromise the confidentiality, integrity, and availability of user data. To protect your site, update to a fixed version of JiZhiCMS as soon as possible.

Original advisory text

JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in the release function within app/home/c/UserController.php. The application attempts to sanitize input by filtering <script> tags but fails to recursively remove dangerous event handlers in other HTML tags (such as onerror in <img> tags). This allows an authenticated remote attacker to inject arbitrary web script or HTML via the body parameter in a POST request to /user/release.html.

References

https://gist.github.com/w-p-man/790f51f918499798180a8def3a6fdfb0 URL
http://www.demo.com/user/release/molds/article.html URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29840... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-29840 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published24 Mar 2026

Updated26 Oct 2026

First seen24 Mar 2026

Sources

CVE-2026-29840 · NVD

CVE-2026-29840 · OSV

Track software like this

Free during beta