{"id":"CVE-2026-29840","details":"JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in the release function within app/home/c/UserController.php. The application attempts to sanitize input by filtering \u003cscript\u003e tags but fails to recursively remove dangerous event handlers in other HTML tags (such as onerror in \u003cimg\u003e tags). This allows an authenticated remote attacker to inject arbitrary web script or HTML via the body parameter in a POST request to /user/release.html.","modified":"2026-08-12T03:51:08.731947301Z","published":"2026-03-24T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29840.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"http://www.demo.com/user/release/molds/article.html"},{"type":"WEB","url":"https://gist.github.com/w-p-man/790f51f918499798180a8def3a6fdfb0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29840.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29840"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cherry-toto/jizhicms","events":[{"introduced":"0"},{"last_affected":"0105eca4b79d6649e72d35fe4b1744358c8f1e5a"}],"database_specific":{"cpe":"cpe:2.3:a:jizhicms:jizhicms:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"2.5.6"}],"source":"CPE_RANGE"}}],"versions":["v2.5.6","2.5.6","v2.5.5","v2.5.4","v2.5.3","2.5.4","2.5.3","2.5.2","2.5.1","2.5.0","2.4.9","2.4.8","2.4.7","v2.4.5","2.4","2.4.3","2.4.0","2.3.7","2.3.5","2.3.4","2.3.8","2.3.3","v1.9.x","v1","v1.6.2","v1.6.1","v1.6","v1.5.2","v1.5.1","v1.5","v1.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29840.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}