CVE-2026-3292 - Vulnerability Analysis
MediumCVSS: 6.3Last Updated: February 27, 2026
jizhiCMS - SQL Injection
Published: February 27, 2026Updated: February 27, 2026PoC AvailableRemote Exploitable
Overview
jizhiCMS <= 2.5.6 contains a SQL injection caused by manipulation of the "data" argument in the findAll function of frphp/lib/Model.php Batch Interface, letting remote attackers execute arbitrary SQL queries, exploit requires crafted input.
Severity & Score
Severity: Medium
CVSS Score: 6.3
Impact
Remote attackers can execute arbitrary SQL queries, potentially leading to data disclosure or modification.
Mitigation
Update to the latest version.
References
Related Resources
Details
- CVE ID
- CVE-2026-3292
- Severity
- Medium
- CVSS Score
- 6.3
- Type
- sql_injection
- Status
- confirmed
CWE
- CWE-74
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L