CVE-2026-5249

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in gougucms version 4.08.18 within the file \gougucms-master\app\admin\view\user\record.html. The Record Endpoint is vulnerable as user-controlled data from the attribute value.content is directly appended to an HTML string without validation or sanitization. When an administrator views the record management page, the document is passed to $('#logs').append(html), allowing the jQuery library to parse and execute any included HTML or script tags [1].

Exploitation

An attacker with a low-privileged account can inject a malicious payload—such as ` or `—into the record endpoint through a submit form. The payload is stored in the database and automatically executed when an administrator accesses the operational records or logs in the backend dashboard. No special authentication is required beyond a normal user account, and the attack can be performed remotely [1].

Impact

Successful exploitation leads to potential session hijacking and unauthorized administrative actions. Because the script runs in the administrator's browser context, the attacker could steal administrative session cookies or perform actions without consent, effectively compromising the entire application. The published CVSS v3 score from the reference is 8.8 (High) [1].

Mitigation

The vendor was contacted but did not respond, and no patch has been released. Users should apply input sanitization for the value.content field and consider restricting access to the record pages. The exploit has been publicly disclosed, and the vulnerability may be added to CISA KEV in the future [1].