OFCMS CVE-2026-10203

Q: What is the CVSS score of CVE-2026-10203?

CVE-2026-10203 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33525 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-01 cna@vuldb.com

GHSA-c5w8-92g9-6wrj

Java SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 00:27 vuln.today

DescriptionCVE.org

A security flaw has been discovered in OFCMS 1.1.3. Impacted is the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SystemParamController.java of the component JSON Query Interface. The manipulation results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in OFCMS 1.1.3's JSON Query Interface allows authenticated remote attackers to manipulate database queries via the Query function in SystemParamController.java. A public proof-of-concept exploit has been released (CVSS E:P confirmed), while the vendor has not responded to the responsible disclosure report, leaving the vulnerability unpatched. The CVSS 4.0 score of 2.1 reflects low-privilege authentication requirements and limited blast radius, but the existence of public exploit code and the absence of any vendor patch elevates practical concern for deployments with internet-exposed admin interfaces.

Technical ContextAI

OFCMS is a Java-based open-source content management system hosted on Gitee. The vulnerability resides in the Query function of SystemParamController.java within the admin module at ofcms-admin/src/main/java/com/ofsoft/cms/admin/controller/system/SystemParamController.java. The affected component is the JSON Query Interface, which processes user-supplied query parameters without adequate sanitization or parameterization. CWE-74 (Injection) is cited as the root cause class - broader than the more specific CWE-89 (SQL Injection) - indicating that user-controlled input is directly incorporated into database query construction without proper neutralization of special elements. This pattern typically arises when dynamic query building concatenates raw input strings rather than using prepared statements or ORM-level binding, a common anti-pattern in Java web applications using direct JDBC or lightweight query builders.

RemediationAI

No vendor-released patch has been identified at time of analysis - the OFCMS maintainers were notified via a Gitee issue report (https://gitee.com/oufu/ofcms/issues/IJLIYP) but have not responded. Organizations should immediately restrict network access to the OFCMS admin interface, particularly the system parameter and JSON Query Interface endpoints, to trusted IP ranges or internal networks only, as exploitation requires an authenticated session that is only reachable if the admin panel is exposed. Disabling or blocking access to the SystemParamController route (e.g., /system/param or equivalent admin query endpoints) via web server or reverse proxy ACLs reduces the attack surface without requiring application changes. Deploying a WAF rule targeting SQL injection signatures on admin API paths provides an additional compensating control, though WAF bypasses are possible with sufficiently obfuscated payloads. Enforce the principle of least privilege for all OFCMS admin accounts to limit the pool of users who could exploit this vulnerability. Monitor the Gitee repository at https://gitee.com/oufu/ofcms for any forthcoming patch and apply it immediately given the public PoC availability.