Description
CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cat_id parameter. Attackers can send GET requests to category.php with malicious cat_id values to extract sensitive database information including usernames and credentials.
Exploits (1)
References (3)
Core 3
Core References
Third Party Advisory third-party-advisory
VulnCheck Advisory: CMSsite 1.0 SQL Injection via category.php
https://www.vulncheck.com/advisories/cmssite-sql-injection-via-category-php
Scores
CVSS v3
8.2
EPSS
0.0024
EPSS Percentile
47.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-89
Status
published
Products (2)
victoralagwu/cmssite
1.0
VictorAlagwu/CMSsite
1.0
Published
Apr 12, 2026
Tracked Since
Apr 12, 2026