Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck

CVE-2026-73670CMS Admin SQL Injection via db_data.php table_name Parameter

High 7.2

In plain English

A high-severity SQL injection in Saurus CMS Community Edition from Saurus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.5%top 55.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the table_name GET or POST parameter. Attackers can perform table traversal, time-based blind, boolean-based blind, and error-based injection techniques to enumerate full database schema, access system tables such as information_schema, and chain the disclosure with secondary injection points to extract credential data.

Affected products (as reported)

Vendor	Product	Versions
Saurus	Saurus CMS Community Edition	0 – through d886e5b

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Product Repository product
Blog Post technical-description
Blog Post
https://www.vulncheck.com/advisories/cms-admin-sql-injection-via-db-data-php-table-name-parameter third-party-advisory