What is the CVSS score of CVE-2026-36962?

CVE-2026-36962 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of MuuCMF are affected by CVE-2026-36962?

MuuCMF T6 v1.9.4.20260115 contains a SQL injection vulnerability allowing unauthenticated attackers to extract entire company databases, forge administrative credentials, and potentially execute…

How to fix or mitigate CVE-2026-36962?

Within 24 hours: inventory all systems running MuuCMF T6 version 1.9.4.20260115 or earlier, assess network exposure to untrusted users, and segregate vulnerable systems from the internet if operationally feasible. Within 7 days: deploy Web Application Firewall rules targeting SQL injection patterns in the keyword parameter of /index/controller/Search.php, implement rate limiting on the search endpoint, enforce strict input validation on all user inputs to the search function, and configure database service accounts with least-privilege access permissions. Within 30 days: contact Muu vendors and obtain security updates or patched versions of MuuCMF T6; if no patch becomes available, evaluate migration to a maintained alternative CMS platform, conduct comprehensive audit log review for signs of exploitation attempts, and harden remaining systems with additional compensating controls.

MuuCMF CVE-2026-36962

EUVD-2026-29112 HIGH

SQL Injection (CWE-89)

2026-05-11 mitre

GHSA-mg69-g739-6rc3

PHP RCE SQLi N A

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

9.8 CRITICAL

Unauthenticated low-complexity network SQLi giving full DB read/write and admin takeover justifies C:H/I:H/A:H; NVD's Low impact scoring appears to understate the described compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:04 vuln.today

CVSS changed

May 12, 2026 - 20:22 NVD

7.3 (HIGH)

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 11, 2026 - 00:00 nvd

HIGH 7.3

DescriptionCVE.org

SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve unauthorized administrative access, and potentially gain remote code execution by writing malicious files to the server's file system via the keyword parameter in the /index/controller/Search.php endpoint.

AnalysisAI

SQL injection in MuuCMF T6 v1.9.4.20260115 lets an unauthenticated remote attacker inject arbitrary SQL through the keyword parameter of the /index/controller/Search.php endpoint, exposing the full database and enabling forged administrative access. Because the underlying database and application run with sufficient privileges, the flaw can be escalated to write malicious files to disk and potentially achieve remote code execution. Publicly available exploit code exists (write-up by thinhneee), but the flaw is not on CISA KEV and EPSS is very low at 0.03% (10th percentile).

Technical ContextAI

MuuCMF is a PHP-based content management framework (Gitee project dameng100/muucmf). The vulnerability is a classic CWE-89 SQL Injection: user-controlled input from the search keyword parameter is concatenated into a SQL statement in the Search.php controller without parameterization or sanitization, allowing the attacker to alter query logic. Beyond data exfiltration, PHP/MySQL deployments that permit stacked queries or file operations (e.g. INTO OUTFILE) can let an attacker turn injection into arbitrary file writes within the web root, which is the described path to remote code execution. The CPE data is unhelpful here (cpe:2.3:a:n/a:n/a:*), so exact affected-component identification relies on the description and vendor repository rather than structured NVD product data.

RemediationAI

No vendor-released patch identified at time of analysis; monitor the upstream repository at https://gitee.com/dameng100/muucmf for a fixed release and apply it once published. As compensating controls, restrict or block external access to the /index/controller/Search.php search endpoint at the web server or WAF layer and add signatures for SQL metacharacters in the keyword parameter - note this may break legitimate site search. Enforce least-privilege on the MySQL account used by MuuCMF, specifically revoking FILE privilege and disabling secure_file_priv/INTO OUTFILE writes to prevent the injection from being escalated to file-write RCE (trade-off: none for most deployments, as web apps rarely need FILE). Ensure the web root and upload directories are not writable by the database or PHP process where feasible, and place the application behind authentication or IP allow-listing if it is not meant to be publicly exposed. Reference the technical write-up at https://thinhneee.github.io/posts/muucmf-sqli/ to validate mitigations.