CVE-2026-10204
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In OFCMS 1.1.3, the Query function in SysUserController.java (JSON Query Interface component) is vulnerable to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
The risk includes reading, modifying, or deleting database data, potentially leading to full system compromise.
Recommendation
Apply patches immediately or temporarily disable the vulnerable JSON Query interface.
Other vulnerabilities in OFCMS
See all- CVE-2026-10203Medium
A vulnerability was found in OFCMS 1.1.3 in the JSON Query interface in SystemParamController.java. The Query function allows SQL injection. The attack can be performed remotely and the exploit has been published.
- CVE-2026-10202Medium
In OFCMS 1.1.3, the Query function in SystemDictController.java (JSON Query Interface component) is vulnerable to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10193Medium
A vulnerability was found in OFCMS up to version 1.1.3 in the file ComnController.java. The Query function with argument system.user.query allows SQL injection. The attack can be performed remotely and the exploit has been published.
Original NVD description (English source)
A weakness has been identified in OFCMS 1.1.3. The affected element is the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SysUserController.java of the component JSON Query Interface. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.