CVE-2026-3946

Low severity, CVSS 3.5. EPSS: 0.3% chance of exploitation in the next 30 days.

A vulnerability was detected in PHPEMS 11.0. The affected element is an unknown function of the file /index.php?ask=app-ask. Performing a manipulation of the argument askcontent results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.

Published 2026-03-11. Last modified 2026-06-17.