CVE-2026-10203

MediumCVSS 6.3/10Last modified Jul 22, 2026

Description

A security flaw has been discovered in OFCMS 1.1.3. Impacted is the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SystemParamController.java of the component JSON Query Interface. The manipulation results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

VendorProductVersions
n/aOFCMS1.1.3

References

Timeline

Published
Jun 1, 2026
Last modified
Jul 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1020307.5An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor tCVE-2026-1020319.8An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to eCVE-2026-1020326.5A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved alCVE-2026-1020336.5An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjCVE-2026-1020346.5A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to CVE-2026-1020356.5A Reachable Assertion vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to caCVE-2026-1020367.5An Integer Overflow or Wraparound vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows a configured ECVE-2026-1020378.1An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices allows an uCVE-2026-1020396.5A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker toCVE-2026-102046.3A weakness has been identified in OFCMS 1.1.3. The affected element is the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\CVE-2026-1020406.5A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauCVE-2026-1020416.5A Reachable Assertion vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthent
CVE-2026-10203: Medium severity, CVSS 6.3 | Vulnix