PT-2026-27229 · Unknown+1 · Connect-Cms+1

Odgrso · Publicado 2026-03-23 · Atualizado 2026-03-24 · CVE-2026-32277

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Connect-CMS versions 1.35.0 through 1.41.0 Connect-CMS versions 2.35.0 through 2.41.0

Description A DOM-based Cross-Site Scripting (XSS) issue exists in the Cabinet Plugin list view. Exploitation requires an authenticated user and could allow arbitrary script execution in the victim's browser, potentially leading to unauthorized actions or information theft. The issue is due to how saved names were rendered.

Recommendations Connect-CMS versions 1.35.0 through 1.41.0: Update to version 1.41.1 or later. Connect-CMS versions 2.35.0 through 2.41.0: Update to version 2.41.1 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-32277

GHSA-CMFH-MPMF-FMQ4

Produtos afetados

Cabinet Plugin

Connect-Cms

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32277.json · Exploit
• https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-cmfh-mpmf-fmq4 · Aviso do Fabricante
• https://github.com/opensource-workshop/connect-cms/commit/c04dc40f814eff891915752ef1ec00ba6612441c · Correção
• https://github.com/opensource-workshop/connect-cms · Nota
• https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1 · Nota
• https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1 · Nota
• https://osv.dev/vulnerability/CVE-2026-32277 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-cmfh-mpmf-fmq4 · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/2036212157474373922 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32277 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2036293488535318586 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2036212332658041013 · Publicação no Twitter