CVE-2026-1953 | Stored XSS — Nukegraphic CMS v3.1.2

Overview

A Stored Cross-Site Scripting (XSS) vulnerability exists in Nukegraphic CMS v3.1.2.
The issue allows an authenticated user to inject malicious JavaScript into the profile name field, which is stored in the backend database and executed automatically wherever the name is rendered across the CMS.

• Product: Nukegraphic CMS
• Version: v3.1.2
• Vulnerability Type: Stored XSS (CWE-79)
• CVSS v3.1: 8.1 (High)
• Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Discovered by: Carlos Budiman & Nicholas Abraham

Affected Endpoint

https://target.com/ngc-cms/user-edit-profile.php

Payload executes CMS-wide.

POC Steps

1. Log in as a valid user.
2. Go to Edit Profile.
3. Intercept the profile update request.
4. Inject the following into the name parameter: