Beveiligingsadvies

CVE-2026-68000

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-08-26 00:00:00

Laatst bijgewerkt 2026-09-01 18:43:46

Toegewezen door mitre

CVSS-score 9.8

Status PUBLISHED

Beschrijving

The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker ${size} without being parameterized and bound. The built-in SqlInjectionUtil employs regular expression blacklist filtering, yet keywords like CREATE/TABLE/SET/PREPARE/EXECUTE are not included in the list, allowing for bypassing. Attackers can execute stacked SQL statements without logging in.

← Alle CVE's bekijken Bekijk op cve.org ↗