CVE-2026-10203
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability was found in OFCMS 1.1.3 in the JSON Query interface in SystemParamController.java. The Query function allows SQL injection. The attack can be performed remotely and the exploit has been published.
Risk Assessment
An attacker can execute arbitrary SQL queries, potentially leading to data leakage or modification.
Recommendation
Update OFCMS to the latest version and use parameterized SQL queries.
Other vulnerabilities in OFCMS
See all- CVE-2026-10204Medium
In OFCMS 1.1.3, the Query function in SysUserController.java (JSON Query Interface component) is vulnerable to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10202Medium
In OFCMS 1.1.3, the Query function in SystemDictController.java (JSON Query Interface component) is vulnerable to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10193Medium
A vulnerability was found in OFCMS up to version 1.1.3 in the file ComnController.java. The Query function with argument system.user.query allows SQL injection. The attack can be performed remotely and the exploit has been published.
Original NVD description (English source)
A security flaw has been discovered in OFCMS 1.1.3. Impacted is the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SystemParamController.java of the component JSON Query Interface. The manipulation results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.