Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-6184-stored-XSS — Proof-of-concept for a stored XSS vulnerability in Simple Content Management System PHP, demonstrating session cookie theft via unsanitized News Title input. | Kitploit
Tools/GitHubGitHub/xmyronn/cve-2026-6184-stored-xss
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHubxmyronn/cve-2026-6184-stored-xss

CVE-2026-6184-stored-XSS

Proof-of-concept for a stored XSS vulnerability in Simple Content Management System PHP, demonstrating session cookie theft via unsanitized News Title input.

View Repository
4 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Stored XSS in News Title - Simple Content Management System PHP

Description

A Stored Cross-Site Scripting (XSS) vulnerability exists in Simple Content Management System PHP. The News Title field in the admin panel does not sanitize user input before storing it in the database and reflecting it on the public index page. Any visitor who browses the main page will trigger the stored XSS payload, allowing an attacker to steal session cookies and hijack accounts.

Vulnerability Details

  • Type: Stored Cross-Site Scripting (CWE-79)
  • Impact: Session Hijacking / Cookie Theft
  • Affected File: /web/admin/welcome.php
  • Affected Parameter: News Title field
  • Attack Vector: Remote, Authenticated (Admin)
  • Triggered On: /web/index.php (public, unauthenticated)

Vendor

code-projects.org

Product

Simple Content Management System PHP

Version

1.0

Proof of Concept (PoC)

Step 1 - Login to admin panel and go to Add News:

http://[target]/web/admin/welcome.php?addnews

Step 2 - Enter XSS payload in News Title field:

Step 3 - Submit the form:

Screenshot 2026-04-05 051828

Step 4 - Visit the public index page:

http://[target]/web/index.php

Step 5 - XSS executes and leaks session cookies:

Screenshot 2026-04-05 051844

Impact

Any user visiting the public index page will have their session cookies exposed to the attacker. This allows full session hijacking and account takeover of any logged in user including administrators.

Author

Imad Alvi

Refernce

https://code-projects.org/simple-content-management-system-in-php-with-source-code/

Download Tool