Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-68000: MCMS web page can let attackers run database commands
CVE-2026-68000 · published 8 days ago
Summary
The MCMS content management system (versions up to 6.2.0) includes a web page that takes a size value and inserts it straight into a database query. By sending a crafted value, an attacker can make the system execute additional commands, giving them the ability to view, change, or delete data without logging in. Install the latest software release or apply the vendor’s security update, and ensure the page validates all input before using it in database operations.
Original advisory text
The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker ${size} withou...
The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker ${size} without being parameterized and bound. The built-in SqlInjectionUtil employs regular expression blacklist filtering, yet keywords like CREATE/TABLE/SET/PREPARE/EXECUTE are not included in the list, allowing for bypassing. Attackers can execute stacked SQL statements without logging in.
Severity
9.8
Critical
Exploitation
EPSS <1%
Type
CWE-89SQL Injection
Timeline
Published26 Aug 2026
Updated2 Sep 2026
First seen26 Aug 2026
Monitor software like this
Free during beta