Security Advisory

CVE-2026-7435

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-04-30 20:09:17

Last updated 2026-05-04 13:24:44

Assigner VulnCheck

CVSS score 8.6

State PUBLISHED

Description

SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without parameterization or sanitization. Attackers can craft encrypted payloads submitted to the /api/stl/actions/dynamic endpoint to execute arbitrary SQL statements, leading to unauthorized database access, data disclosure, authentication bypass, data modification, or complete database compromise.

← Browse all CVEs View on cve.org ↗