CVE-2026-1978
CVE-2026-1978 is a medium-severity vulnerability in Kalyan02 Nanocms with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-425.
Key facts
- Severity: Medium (CVSS 3.x base score 5.3)
- CVSS v2: 5.0
- CVSS v4: 5.5
- EPSS exploit prediction: 0% (28th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-5600
- Weakness: CWE-425
- Affected product: Kalyan02 Nanocms
- Published:
- Last modified:
Description
A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate the attack remotely. The exploit is now public and may be used. You should change the configuration settings.
Frequently asked questions
- What is CVE-2026-1978?
- A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate the attack remotely. The exploit is now public and may be used. You should change the configuration settings.
- How severe is CVE-2026-1978?
- CVE-2026-1978 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
- Is CVE-2026-1978 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-1978?
- CVE-2026-1978 affects Kalyan02 Nanocms. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-1978?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-1978 have an EU (EUVD) identifier?
- Yes. CVE-2026-1978 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-5600.
- When was CVE-2026-1978 published?
- CVE-2026-1978 was published on 2026-02-06 and last updated on 2026-06-17.
References
- https://github.com/kalyan02/NanoCMS/
- https://github.com/kalyan02/NanoCMS/blob/master/data/pagesdata.txt
- https://vuldb.com/?ctiid.344500
- https://vuldb.com/?id.344500
- https://vuldb.com/?submit.743260
Affected products (1)
- cpe:2.3:a:kalyan02:nanocms:*:*:*:*:*:*:*:*
More vulnerabilities in Kalyan02 Nanocms
- CVE-2022-50898 — High (CVSS 8.8): NanoCMS 0.4 contains an authenticated file upload vulnerability that allows remote code execution through unvalidated…
All CVEs affecting Kalyan02 Nanocms →
Other CWE-425 vulnerabilities
- CVE-2025-26689 — Critical (CVSS 9.8): Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote…
- CVE-2024-0204 — Critical (CVSS 9.8): Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via…
- CVE-2022-45276 — Critical (CVSS 9.8): An issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated attackers to obtain the…
- CVE-2022-26279 — Critical (CVSS 9.8): EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.
- CVE-2021-36560 — Critical (CVSS 9.8): Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads…
- CVE-2021-36745 — Critical (CVSS 9.8): A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for…