Qcms CVE-2026-67854

The vulnerable code path is the Qcms backend 'tableField' action, as named in the referenced audit report - exploitation requires the attacker to reach and submit input to that backend/admin function on a Qcms 6.0.6 instance. The 'Backend' designation indicates the primary limiting factor: authenticated or backend-accessible access is most likely needed, which contradicts the CVSS PR:N metric and should be verified against the vendor and the write-up. No user interaction is required and the vector is network-reachable, so any Qcms 6.0.6 deployment exposing its backend to an attacker who can authenticate (or reach it unauthenticated if PR:N holds) is at risk; the authentication precondition, not network reachability, is the key constraint.

Signals conflict and must be weighed rather than taken at face value. The CVSS 3.1 vector is a maximal 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), which would imply trivial unauthenticated network exploitation, but the reference title explicitly describes a 'Backend SQL Injection' in a tableField admin action, strongly implying that authenticated backend/admin access is actually required - so PR:N is likely overstated and should be verified against the vendor/write-up. Countervailing the high CVSS, EPSS is only 0.20% (10th percentile) and the CVE is not in CISA KEV, so there is no indication of active or mass exploitation; a mid-sized operator such as a municipal IT team in koszalin running this CMS should still patch promptly given SQLi's reliability, but this reads as a targeted rather than internet-wide threat. Net: treat as a genuine high-severity issue for anyone actually running Qcms 6.0.6, but a moderate real-world priority given the product's small footprint, low EPSS, absence of KEV listing, and the likely authentication precondition.

An attacker with reach to the Qcms backend submits a crafted value to the vulnerable tableField action, injecting SQL that extracts credentials or session data from the database and potentially chains stacked queries or file-write primitives toward code execution. A detailed white-box audit write-up describing the injection point is publicly available, lowering the effort to reproduce, though a packaged exploit is not confirmed in the input. Because the affected function is in the backend, the attacker most plausibly needs valid or low-privileged admin access despite the CVSS marking PR:N.