CVE-2026-29934

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-26 · updated 2026-06-17
Weakness: CWE-79

Description

A reflected cross-site scripting (XSS) vulnerability in the /admin/menus component of Lightcms v2.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via modifying the referer value in the request header.

Affected products

Lightcms Project Lightcms: 2.0

References

https://github.com/eddy8/LightCMS/issues/38

Get alerted when CVE-2026-29934 or the next vulnerability affects your stack