Which versions of Java are affected by CVE-2026-4954?

Organizations using A security vulnerability should be aware of moderate risk from CVE-2026-4954, a SQL injection vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for CVE-2026-4954?

Yes, a public proof-of-concept exploit is available for CVE-2026-4954. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4954?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Java CVE-2026-4954

Q: What is the CVSS score of CVE-2026-4954?

CVE-2026-4954 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16630 LOW

SQL Injection (CWE-89)

2026-03-27 VulDB

Java SQLi Mcms Mingsoft

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 14:30 euvd

EUVD-2026-16630

Analysis Generated

Mar 27, 2026 - 14:30 vuln.today

CVE Published

Mar 27, 2026 - 14:13 nvd

MEDIUM 5.3

DescriptionCVE.org

A security vulnerability has been detected in mingSoft MCMS 迄 5.5.0. Impacted is the function list of the file net/mingsoft/cms/action/web/ContentAction.java of the component Web Content List Endpoint. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in mingSoft MCMS 5.5.0 allows authenticated remote attackers to manipulate the Web Content List Endpoint (ContentAction.java) and execute arbitrary database queries, potentially leading to unauthorized data disclosure, modification, or deletion. The vulnerability requires low-privilege authentication (CVSS PR:L) and has publicly available exploit code disclosed on GitHub, making it an active threat to deployed MCMS instances.

Technical ContextAI

The vulnerability exists in the net/mingsoft/cms/action/web/ContentAction.java component, specifically in the list function of the Web Content List Endpoint. The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating insufficient input validation or parameterized query usage when processing user-supplied parameters in SQL statements. mingSoft MCMS is a Java-based content management system, and the affected component handles HTTP requests for content enumeration without proper sanitization, allowing attackers to inject malicious SQL syntax through request parameters. The CPE designation (cpe:2.3:a:mingsoft:mcms:*:*:*:*:*:*:*:*) indicates the vulnerability affects multiple versions of the MCMS product line.

RemediationAI

Immediately upgrade mingSoft MCMS to a patched version released after the vulnerability disclosure (specific patch version number not provided in available data; consult mingSoft vendor advisory and VulDB reference vuldb.com/?id.353832 for the exact target version). Until patching is feasible, implement the following mitigations: (1) restrict network access to the ContentAction.java endpoint using firewall rules or reverse proxy ACLs, permitting only trusted internal IP ranges; (2) enforce strong authentication and monitor for anomalous SQL queries in database logs; (3) apply Web Application Firewall (WAF) rules to detect and block SQL injection payloads in HTTP requests to /cms/web/content/list or similar endpoints; (4) consider disabling the list endpoint entirely if not actively used in production workflows. Monitor the public exploit repository (github.com/wing3e/public_exp) and VulDB for updates on patch availability.