CVE-2026-10193 - OFCMS ComnController ComnController.java query sql injection

Back Back to CVE browser

MEDIUM

OFCMS ComnController ComnController.java query sql injection

Published May 31, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.20%

Description

A security flaw has been discovered in OFCMS up to 1.1.3. The impacted element is the function Query of the file ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\ComnController.java of the component ComnController. Performing a manipulation of the argument system.user.query results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

Vendor Ofcms Product Ofcms Default
n/a
- Version
  1.1.0
  Status
  affected
  Constraints
  -
- Version
  1.1.1
  Status
  affected
  Constraints
  -
- Version
  1.1.2
  Status
  affected
  Constraints
  -
- Version
  1.1.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Ofcms

n/a

Version	Status	Constraints
1.1.0	affected	-
1.1.1	affected	-
1.1.2	affected	-
1.1.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-89

SQL Injection

References (5)

https://gitee.com/oufu/ofcms/issues/IJLFCA
exploitissue-tracking
https://vuldb.com/cve/CVE-2026-10193
third-party-advisory
https://vuldb.com/submit/820665
third-party-advisory
https://vuldb.com/vuln/367474
vdb-entrytechnical-description
https://vuldb.com/vuln/367474/cti
signaturepermissions-required

Link	Providers	Tags
https://gitee.com/oufu/ofcms/issues/IJLFCA		exploitissue-tracking
https://vuldb.com/cve/CVE-2026-10193		third-party-advisory
https://vuldb.com/submit/820665		third-party-advisory
https://vuldb.com/vuln/367474		vdb-entrytechnical-description
https://vuldb.com/vuln/367474/cti		signaturepermissions-required