CVE-2026-68000
Low risk· EPSS 5%Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The /cms/category/list interface in MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause via FreeMarker ${size} without parameterization. The SqlInjectionUtil filter does not block keywords like CREATE/TABLE/SET/PREPARE/EXECUTE, allowing bypass and execution of stacked SQL statements without login.
Risk Assessment
An unauthenticated attacker can execute arbitrary SQL queries, potentially leading to data confidentiality, integrity, and availability breaches.
Recommendation
Update MCMS to the latest version and use parameterized SQL queries instead of concatenation in FreeMarker.
Other vulnerabilities in MCMS
See all- CVE-2025-29287Critical
An arbitrary file upload vulnerability was found in the ueditor component of MCMS version 5.4.3. Attackers can exploit this flaw to execute arbitrary code by uploading a crafted file.
- CVE-2026-52203High
Vulnerability in MCMS version 6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.
- CVE-2025-60837Medium
A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload.
- CVE-2025-60838Medium
An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code by uploading a crafted file.
Original NVD description (English source)
The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker ${size} without being parameterized and bound. The built-in SqlInjectionUtil employs regular expression blacklist filtering, yet keywords like CREATE/TABLE/SET/PREPARE/EXECUTE are not included in the list, allowing for bypassing. Attackers can execute stacked SQL statements without logging in.