CVE-2026-7435 SSCMS v7.4.0 SQL Injection via stl:sqlContent queryString
Attackers can execute arbitrary SQL statements via the stl:sqlContent tag in SSCMS, leading to unauthorized database access and data compromise.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-7435?
CVE-2026-7435 is a high-severity SQL injection vulnerability in siteserver SSCMS, published on 30 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without parameterization or sanitization. Attackers can craft encrypted payloads submitted to the /api/stl/actions/dynamic endpoint to execute arbitrary SQL statements, leading to unauthorized database access, data disclosure, authentication bypass, data modification, or complete database compromise.
Weakness: CWE-89
Which versions are affected by CVE-2026-7435?
How do I fix CVE-2026-7435?
No fix has been published for CVE-2026-7435 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-7435 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-7435 exists.
Sources
Also known as GHSA-vhhj-g588-8p4h.