A vulnerability was identified in EasyCMS up to 1.6. This vulnerability affects unknown code of the file /UserAction.class.php. Such manipulation of the argument _order leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://github.com/ueh1013/VULN/issues/15 | Exploit Issue Tracking Mitigation Third Party Advisory |
| https://vuldb.com/?ctiid.341697 | Permissions Required VDB Entry |
| https://vuldb.com/?id.341697 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.731465 | Third Party Advisory VDB Entry |
Configurations
History
06 Feb 2026, 20:19
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/ueh1013/VULN/issues/15 - Exploit, Issue Tracking, Mitigation, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.341697 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.341697 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.731465 - Third Party Advisory, VDB Entry | |
| First Time |
Easycms easycms
Easycms |
|
| CPE | cpe:2.3:a:easycms:easycms:*:*:*:*:*:*:*:* |
18 Jan 2026, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-18 00:15
Updated : 2026-02-06 20:19
NVD link : CVE-2026-1105
Mitre link : CVE-2026-1105
CVE.ORG link : CVE-2026-1105
JSON object : View
Products Affected
easycms
- easycms