OFCMS CVE-2026-10204

Q: What is the CVSS score of CVE-2026-10204?

CVE-2026-10204 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33526 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-01 cna@vuldb.com

GHSA-7q9m-w2v3-fh9v

Java SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 00:27 vuln.today

DescriptionCVE.org

A weakness has been identified in OFCMS 1.1.3. The affected element is the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SysUserController.java of the component JSON Query Interface. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in OFCMS 1.1.3 enables authenticated remote attackers to manipulate database queries through the JSON Query Interface exposed in SysUserController.java. Publicly available exploit code exists (confirmed by CVSS 4.0 E:P modifier and the CVE description), raising the practical risk above what the low CVSS 4.0 score of 2.1 implies. The project maintainers were notified via a Gitee issue report but have not responded, meaning no vendor patch exists at time of analysis - defenders must rely entirely on compensating controls.

Technical ContextAI

OFCMS is an open-source Java-based content management system. The vulnerable code resides in the admin-tier controller at ofcms-admin/src/main/java/com/ofsoft/cms/admin/controller/system/SysUserController.java, specifically in the Query function that processes requests from the JSON Query Interface - an administrative endpoint for querying system user data. CWE-74 (Injection) is the root cause class: user-supplied JSON query parameters are not sanitized or parameterized before being incorporated into SQL statement construction, allowing an attacker to alter query logic. The injection point is within the application's admin controller layer, implying the database user context likely holds elevated schema privileges. No CPE strings were provided in the available intelligence.

RemediationAI

No vendor-released patch is available at time of analysis - the project maintainer has not responded to the disclosure issue at https://gitee.com/oufu/ofcms/issues/IJLL09. Organizations running OFCMS 1.1.3 should implement the following compensating controls: restrict network access to the OFCMS admin panel to trusted IP ranges using firewall rules or a reverse proxy allowlist, which eliminates network-vector exploitation entirely but may affect legitimate remote admin workflows. Deploy a Web Application Firewall with SQL injection detection rules targeting the SysUserController Query endpoint specifically, noting that WAF bypass remains possible for determined attackers. Audit and reduce privileges of the database account used by OFCMS to the minimum required (read-only where possible), limiting what an injected query can reach. Organizations with high-sensitivity data should consider decommissioning or replacing OFCMS 1.1.3 given the absence of any upstream maintenance response.