Is there a public PoC exploit available for CVE-2026-10193?

Yes, a public proof-of-concept exploit is available for CVE-2026-10193. Prioritise patching immediately. EPSS: 0.0%.

OFCMS CVE-2026-10193

Q: What is the CVSS score of CVE-2026-10193?

CVE-2026-10193 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33515 LOW

SQL Injection (CWE-89)

2026-05-31 VulDB

GHSA-9j66-w44g-r7xq

Java SQLi N A Ofcms

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 31, 2026 - 17:22 NVD

MEDIUM LOW

CVSS changed

May 31, 2026 - 17:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 31, 2026 - 16:51 vuln.today

DescriptionCVE.org

A security flaw has been discovered in OFCMS up to 1.1.3. The impacted element is the function Query of the file ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\ComnController.java of the component ComnController. Performing a manipulation of the argument system.user.query results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in OFCMS versions up to 1.1.3 allows remote low-privileged attackers to inject arbitrary SQL through the system.user.query argument within the ComnController.Query function, achieving partial compromise of confidentiality, integrity, and availability against the underlying database. Publicly available exploit code exists - referenced via Gitee issue IJLFCA - elevating practical risk above what the moderate CVSS base score of 6.3 alone suggests. No vendor patch has been released; the project maintainer has not responded to the responsible disclosure report, leaving all 1.1.3-and-below deployments unmitigated.

Technical ContextAI

OFCMS is an open-source Java-based content management system. The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements in an SQL Command): the Query function in ofcms-admin/src/main/java/com/ofsoft/cms/admin/controller/ComnController.java accepts the HTTP parameter system.user.query and incorporates it into a database query without adequate parameterization or sanitization. This is a textbook SQL injection pattern in a Java servlet/controller layer, likely targeting a relational backend such as MySQL given common OFCMS deployments. The affected CPE string cpe:2.3:a:n/a:ofcms:*:*:*:*:*:*:*:* covers all OFCMS versions through 1.1.3. The admin controller context means the endpoint is part of the administrative HTTP interface, not the public-facing CMS frontend.

RemediationAI

No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to the responsible disclosure, confirmed by RL:X in the CVSS temporal vector. As an immediate compensating control, restrict access to the OFCMS administrative interface to trusted IP ranges via firewall or reverse-proxy ACLs, directly countering the AV:N attack vector - note this does not eliminate risk if trusted network users are the threat model. Deploy a WAF rule targeting SQL metacharacter injection in the system.user.query request parameter; this is bypassable by advanced evasion techniques and should be treated as depth-in-defense, not a fix. Enforce minimal database privileges for the OFCMS service account (read-only where possible) to constrain the impact of a successful injection to C:L rather than full database compromise. Monitor the Gitee project at https://gitee.com/oufu/ofcms and VulDB at https://vuldb.com/cve/CVE-2026-10193 for any upstream patch release. Organizations with a dependency on OFCMS should evaluate migration to an actively maintained CMS as a strategic remediation given the absent vendor response.