Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
EasyCMS < 1.6: Remote SQL Injection via Malicious Order Parameter
CVE-2026-3785
Summary
A security flaw in EasyCMS versions up to 1.6 allows an attacker to inject malicious SQL code by manipulating the _order parameter. This could lead to unauthorized data access or modification. To protect your site, update to the latest version of EasyCMS or patch the affected file manually.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| easycms | easycms | <= 1.6 | – |
Original title
A vulnerability was identified in EasyCMS up to 1.6. The affected element is an unknown function of the file /RbacnodeAction.class.php of the component Request Parameter Handler. The manipulation o...
Original description
A vulnerability was identified in EasyCMS up to 1.6. The affected element is an unknown function of the file /RbacnodeAction.class.php of the component Request Parameter Handler. The manipulation of the argument _order leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
nvd CVSS2.0
6.5
nvd CVSS3.1
6.3
nvd CVSS4.0
5.3
Vulnerability type
CWE-74
Injection
CWE-89
SQL Injection
Published: 8 Mar 2026 · Updated: 13 Mar 2026 · First seen: 8 Mar 2026