Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
EasyCMS SQL Injection Flaw Allows Remote Attacks
CVE-2026-3786
Summary
A security flaw in EasyCMS 1.6 and earlier allows attackers to inject malicious SQL code, potentially giving them access to sensitive data. This flaw can be exploited remotely, and an exploit is already available. If you use EasyCMS, update to the latest version as soon as possible to fix this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| easycms | easycms | <= 1.6 | – |
Original title
A security flaw has been discovered in EasyCMS up to 1.6. The impacted element is an unknown function of the file /RbacuserAction.class.php of the component Request Parameter Handler. The manipulat...
Original description
A security flaw has been discovered in EasyCMS up to 1.6. The impacted element is an unknown function of the file /RbacuserAction.class.php of the component Request Parameter Handler. The manipulation of the argument _order results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
nvd CVSS2.0
6.5
nvd CVSS3.1
6.3
nvd CVSS4.0
5.3
Vulnerability type
CWE-74
Injection
CWE-89
SQL Injection
Published: 8 Mar 2026 · Updated: 13 Mar 2026 · First seen: 8 Mar 2026