CVE-2026-29598

MEDIUM

DDSN Interactive Acora CMS 10.7.1 - XSS

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-29598. PoCs published by padayali-JD.

AI-analyzed exploit summary The repository describes a Stored XSS vulnerability in cm3 Acora CMS version 10.7.1, where malicious scripts can be injected into user fields via specific endpoints. The scripts are stored in the database and executed when rendered in the UI.

Description

Multiple stored cross-site scripting (XSS) vulnerabilities in the submit_add_user.asp endpoint of DDSN Interactive Acora CMS v10.7.1 allow attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the First Name and Last Name parameters.

Exploits (1)

nomisec WRITEUP
by padayali-JD · poc
https://github.com/padayali-JD/CVE-2026-29598

The repository describes a Stored XSS vulnerability in cm3 Acora CMS version 10.7.1, where malicious scripts can be injected into user fields via specific endpoints. The scripts are stored in the database and executed when rendered in the UI.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: cm3 Acora CMS version 10.7.1
Auth required
Prerequisites: Administrator access to add/edit users
devstral-2 · analyzed May 03, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 5.4
EPSS 0.0020
EPSS Percentile 10.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Published Apr 01, 2026
Tracked Since Apr 01, 2026