CVE-2026-67854

CriticalCVSS 9.8

Published: 17/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code.

An attacker can take control of the application or database, potentially leading to data confidentiality and integrity breaches.

Immediately update Qcms to the latest version and implement input validation and prepared SQL statements.

Original NVD description (English source)

SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code