CVE-2026-10202
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In OFCMS 1.1.3, the Query function in SystemDictController.java (JSON Query Interface component) is vulnerable to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
The risk includes reading, modifying, or deleting database data, potentially leading to full system compromise.
Recommendation
Apply patches immediately or temporarily disable the vulnerable JSON Query interface.
Other vulnerabilities in OFCMS
See all- CVE-2026-10204Medium
In OFCMS 1.1.3, the Query function in SysUserController.java (JSON Query Interface component) is vulnerable to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10203Medium
A vulnerability was found in OFCMS 1.1.3 in the JSON Query interface in SystemParamController.java. The Query function allows SQL injection. The attack can be performed remotely and the exploit has been published.
- CVE-2026-10193Medium
A vulnerability was found in OFCMS up to version 1.1.3 in the file ComnController.java. The Query function with argument system.user.query allows SQL injection. The attack can be performed remotely and the exploit has been published.
Original NVD description (English source)
A vulnerability was identified in OFCMS 1.1.3. This issue affects the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SystemDictController.java of the component JSON Query Interface. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.