padayali-jd/cve-2026-29598Proof-of-concept for a stored XSS vulnerability in cm3 Acora CMS 10.7.1, demonstrating script injection via user management endpoints.
DDSN Interactive cm3 Acora CMS version 10.7.1 contains a Stored Cross-Site Scripting (XSS) vulnerability in the user management functionality. An administrator with the ability to add or edit user details can inadvertently inject malicious scripts into fields such as "first name" and "last name" via the endpoints “/submit_add_user.asp” and “/submit_edit_user.asp”. These scripts are stored in the application's database and executed whenever the data is rendered in the user interface. This vulnerability enables an attacker to execute arbitrary JavaScript in the context of other users’ browsers, potentially leading to session hijacking, credential theft, or unauthorised actions performed on behalf of the victim.
Discovered by Joby Y Daniel from Crowe India.
