EyouCMS EUVD-2026-26252

Q: What is the CVSS score of EUVD-2026-26252?

EUVD-2026-26252 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7389 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-04-29 cna@vuldb.com

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible, unauthenticated SQL injection with no user interaction or scope change; partial impact across all three pillars consistent with CWE-74 partial injection.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:41 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 16:22 euvd

EUVD-2026-26252

CVE Published

Apr 29, 2026 - 16:16 nvd

MEDIUM 5.5

DescriptionCVE.org

A security vulnerability has been detected in EyouCMS up to 1.7.9. The affected element is the function GetSortData of the file application/common.php. The manipulation of the argument sort_asc leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in EyouCMS versions 1.7.0 through 1.7.9 allows remote unauthenticated attackers to manipulate database queries by passing malicious input via the sort_asc argument to the GetSortData function in application/common.php. A public proof-of-concept has been disclosed on Gitee, and SSVC classifies the attack as automatable with partial technical impact, though EPSS remains very low at 0.03% (8th percentile), indicating limited observed mass exploitation. No vendor patch exists - the project was notified via responsible disclosure but has not responded, leaving all 1.7.x deployments exposed.

Technical ContextAI

EyouCMS is a PHP-based content management system targeting the Chinese-language web market. The vulnerability exists in the GetSortData function within application/common.php, where the sort_asc parameter is incorporated into a database query without proper sanitization or parameterized query binding. This falls under CWE-74 (Injection), a root cause class where user-controlled input is not neutralized before being passed to a downstream interpreter - in this case, the SQL database engine. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the function is reachable over the network without authentication and requires no special attack prerequisites. All versions in the 1.7.x branch (1.7.0 through 1.7.9) are affected per ENISA EUVD-2026-26252.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor was notified via responsible disclosure on Gitee (https://gitee.com/weng_xianhu/eyoucms/issues/IILFPE) but has not responded. As the primary compensating control, deploy a web application firewall rule that strictly allowlists the sort_asc parameter to expected values only (e.g., the literal strings 'asc' or 'desc'), rejecting any other input; this carries negligible functional impact since sort direction is binary. Additionally, configure the database account used by EyouCMS with the minimum required privileges - ideally read-only for front-end query paths - to limit the blast radius of a successful injection to data exfiltration rather than data modification. Organizations should monitor the Gitee issue tracker and VulDB (https://vuldb.com/vuln/360114) for patch availability and apply any released fix immediately upon publication.