Medium severity · published Mar 16, 2026
CVE-2026-4234
SSCMS DDL SitesAddController.Submit.cs sql injection
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A security flaw has been discovered in SSCMS 7.4.0. This vulnerability affects unknown code of the file SitesAddController.Submit.cs of the component DDL Handler. The manipulation of the argument tableHandWrite results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
SSCMS · Sscms
7.4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4234
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4234
vuldb.com
https://vuldb.com/?ctiid.351157
vuldb.com
https://vuldb.com/?id.351157
vuldb.com
https://vuldb.com/?submit.771238
www.yuque.com
https://www.yuque.com/la12138/pa2fpb/uzhex80ydgktvzok?singleDoc
More from SSCMS
6.5
CVE-2025-52237
An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory traversal
5.4
CVE-2026-4542
SSCMS layerImage Endpoint LayerImageController.Submit.cs path traversal
5.4
CVE-2023-43953
SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component
5.0
CVE-2026-82486
SiteServer SSCMS Agent Installation Workflow access control
3.8
CVE-2026-4222
SSCMS download PathUtils.RemoveParentPath path traversal