CVE-2026-3785 - Vulnerability Analysis

Overview

EasyCMS <= 1.6 contains a sql injection caused by manipulation of the _order argument in /RbacnodeAction.class.php Request Parameter Handler, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

Severity & Score

Impact

Remote attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.

Mitigation

Update to the latest version.

References

• https://github.com/ueh1013/VULN/issues/19
• https://vuldb.com/?ctiid.349752
• https://vuldb.com/?id.349752
• https://vuldb.com/?submit.766140

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner