CVE-2026-108566
InstantSoft icms2 Private Message index.tpl.php index cross site scripting
CVSS Score
3.5
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3a1ec8fcb073a46d06a2ab83bc2bf68225834281. It is best practice to apply a patch to resolve this issue.
| CWE | CWE-79 CWE-94 |
| Vendor | instantsoft |
| Product | icms2 |
| Published | Oct 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for instantsoft icms2
Be the first to know when new low vulnerabilities affecting instantsoft icms2 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
InstantSoft / icms2
2.18.0 2.18.1 2.18.2
References
vuldb.com: https://vuldb.com/vuln/416223 vuldb.com: https://vuldb.com/vuln/416223/cti vuldb.com: https://vuldb.com/cve/CVE-2026-108566 vuldb.com: https://vuldb.com/submit/954247 github.com: https://github.com/instantsoft/icms2/commit/3a1ec8fcb073a46d06a2ab83bc2bf68225834281 github.com: https://github.com/instantsoft/icms2/
Credits
🔍 EVIL0RD (VulDB User) VulDB Vulnerability Moderation Team