CVE-2026-1105
Published: 18 January 2026
Summary
CVE-2026-1105 is a medium-severity Injection (CWE-74) vulnerability in Easycms Easycms. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-1105 is a SQL injection vulnerability (CWE-74, CWE-89) in EasyCMS versions up to 1.6. The flaw affects unknown code in the file /UserAction.class.php, where manipulation of the _order argument triggers the injection. Published on 2026-01-18 with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), it enables remote exploitation.
Unauthenticated remote attackers can exploit this vulnerability with low complexity and no user interaction required. Successful attacks allow limited impacts on confidentiality, integrity, and availability through SQL injection, potentially enabling unauthorized data access, modification, or disruption depending on the database backend.
Advisories from VulDB (ctiid.341697, id.341697, submit.731465) and a GitHub issue (ueh1013/VULN/issues/15) confirm the exploit is publicly available and may be in use. The vendor was contacted early for disclosure but provided no response or patches, leaving mitigation to practitioners via input sanitization, web application firewalls, or avoiding vulnerable versions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3192
Vulnerability details
A vulnerability was identified in EasyCMS up to 1.6. This vulnerability affects unknown code of the file /UserAction.class.php. Such manipulation of the argument _order leads to sql injection. The attack can be executed remotely. The exploit is publicly available and…
more
might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote SQL injection in a public-facing web application component enables initial access via exploitation of the vulnerable endpoint.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted inputs such as the _order parameter before it reaches SQL statements in UserAction.class.php.
Boundary-protection mechanisms (e.g., WAF rules) can inspect and block SQL-injection payloads sent remotely to the vulnerable endpoint.
Continuous monitoring of application and database logs can identify anomalous SQL syntax or error patterns indicative of attempted exploitation of the _order parameter.