PT-2026-55054 · U5Cms · U5Cms

Pierre-Yves Guerder · Published 2026-07-02 · Updated 2026-07-02 · CVE-2026-14449

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions u5CMS versions prior to 12.8.9

Description The software is susceptible to reflected Cross-Site Scripting (XSS), a type of attack where malicious scripts are injected into a web page and reflected back to the user. This occurs via the thanks parameter within multiple form components when using POST requests.

Recommendations Update u5CMS to version 12.8.9 or later. As a temporary mitigation, restrict or sanitize the input of the thanks parameter in form components.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-14449

Affected Products

U5Cms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-14449 · Security Note
• https://github.com/u5cms/u5cms/releases/tag/v12.8.9 · Note
• https://t.me/CVEtracker/58701 · Telegram Post