Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator's browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-23704 A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrato… https://www.cve.org/CVERecord?id=CVE-2026-23704
Post summary
The passage discloses CVE‑2026‑23704 as a file‑upload flaw enabling arbitrary script execution by non‑admin users, with no evidence of PoC, exploit code, active attacks, or remediation.
CVE-2026-23704 Cross-Site Scripting in Movable Type 7 and 8.4 Series Allowing Arbitrary Script Execution https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-23704
Post summary
The text announces CVE-2026-23704, a Cross‑Site Scripting vulnerability in Movable Type 7 and 8.4 Series that permits arbitrary script execution.