PT-2026-23985 · Easycms · Easycms

Vuldb + 1 · Publicado 2026-03-08 · Atualizado 2026-03-09 · CVE-2026-3785

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EasyCMS versions up to 1.6

Description A flaw exists in EasyCMS that allows for remote SQL injection. The issue is located in an unknown function within the /RbacnodeAction.class.php file, part of the Request Parameter Handler component. Manipulating the order argument can trigger the injection. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Versions prior to 1.6 should be updated. As a temporary workaround, consider restricting access to the /RbacnodeAction.class.php file or disabling the vulnerable function until a patch is available. Avoid using the order parameter in requests to the affected component.

Exploit

Correção

Special Elements Injection

SQL injection

Enumeração de Fraquezas

CWE-74

CWE-89

Identificadores relacionados

CVE-2026-3785

Produtos afetados

Easycms

Referências · 9

• 🔥 https://github.com/ueh1013/VULN/issues/19 · Exploit
• https://t.me/cveNotify/154724 · Publicação no Telegram
• https://vuldb.com/?ctiid.349752 · Nota
• https://osv.dev/vulnerability/CVE-2026-3785 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2031137191263650235 · Publicação no Twitter
• https://vuldb.com/?id.349752 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3785 · Nota de Segurança
• https://t.me/CVEtracker/46843 · Publicação no Telegram
• https://vuldb.com/?submit.766140 · Nota