Cpe:2.3:a:easycms:easycms:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aeasycmseasycms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 15 Oct 2026 20:04:40 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection Vulnerability in Easycmshttps://feed.craftedsignal.io/briefs/2026-10-easycms-sqli/Thu, 15 Oct 2026 20:04:40 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-easycms-sqli/CVE-2026-3786 is a high-severity SQL injection vulnerability in Easycms version 1.6 and earlier that allows remote attackers to execute arbitrary database commands via the _order parameter.CVE-2026-3786 is a high-severity SQL injection vulnerability affecting Easycms versions 1.6 and earlier. The flaw resides in the 'RbacuserAction.class.php' component, specifically within the handling of the '_order' query parameter. An attacker with low-level privileges can inject malicious SQL statements into this parameter, leading to unauthorized database access, potential data exfiltration, or modification. With the public release of a Proof-of-Concept (PoC) exploit on October 15, 2026, the risk of exploitation has increased for organizations running outdated instances of the platform.

Impact

Successful exploitation of CVE-2026-3786 allows an attacker to achieve full control over the database back-end. This can lead to total compromise of application data, including user credentials and sensitive business information. The CVSS score of 8.8 reflects the high impact on confidentiality, integrity, and availability. All deployments of Easycms version 1.6 or earlier are considered vulnerable and at risk of exploitation.

Recommendation

  • Upgrade to the latest version of Easycms immediately to mitigate the risk associated with CVE-2026-3786.
  • Audit web server logs for HTTP requests containing suspicious SQL injection patterns (such as keywords: SELECT, UNION, FROM, SLEEP, or comment indicators like --) directed at 'RbacuserAction.class.php'.
  • Implement Web Application Firewall (WAF) rules to inspect query parameters for SQL metacharacters and block malicious requests targeting the '_order' parameter.
]]>lowadvisoryweb-vulnerabilitysqliremote-execution