PT-2026-23985 · Easycms · Easycms

Vuldb + 1 · Published 2026-03-08 · Updated 2026-03-09 · CVE-2026-3785

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EasyCMS versions up to 1.6

Description A flaw exists in EasyCMS that allows for remote SQL injection. The issue is located in an unknown function within the /RbacnodeAction.class.php file, part of the Request Parameter Handler component. Manipulating the order argument can trigger the injection. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Versions prior to 1.6 should be updated. As a temporary workaround, consider restricting access to the /RbacnodeAction.class.php file or disabling the vulnerable function until a patch is available. Avoid using the order parameter in requests to the affected component.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-3785

Affected Products

Easycms

References · 9

• 🔥 https://github.com/ueh1013/VULN/issues/19 · Exploit
• https://osv.dev/vulnerability/CVE-2026-3785 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3785 · Security Note
• https://t.me/cveNotify/154724 · Telegram Post
• https://vuldb.com/?ctiid.349752 · Note
• https://twitter.com/CVEnew/status/2031137191263650235 · Twitter Post
• https://vuldb.com/?id.349752 · Note
• https://t.me/CVEtracker/46843 · Telegram Post
• https://vuldb.com/?submit.766140 · Note