Vulnerability · Published Apr 30, 2026 · Assigned by VulnCheck

CVE-2026-7435SSCMS v7.4.0 SQL Injection via stl:sqlContent queryString

High 7.2

In plain English

A high-severity SQL injection in SSCMS from siteserver. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.5%top 54.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without parameterization or sanitization. Attackers can craft encrypted payloads submitted to the /api/stl/actions/dynamic endpoint to execute arbitrary SQL statements, leading to unauthorized database access, data disclosure, authentication bypass, data modification, or complete database compromise.

Affected products (as reported)

Vendor	Product	Versions
siteserver	SSCMS	7.4.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/siteserver/cms/issues/3891 issue-tracking
https://github.com/siteserver/cms product
https://www.vulncheck.com/advisories/sscms-sql-injection-via-stl-sqlcontent-querystring third-party-advisory