High severity · published Sep 15, 2026
CVE-2026-91848
WuzhiCMS index.php getDataOfJson sql injection
7.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson. The manipulation of the argument title/master_table leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WU
WuzhiCMS · Wuzhicms
4.0; 4.1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-91848
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-91848
github.com
https://github.com/wuzhicms/wuzhicms/
github.com
https://github.com/wuzhicms/wuzhicms/issues/218
vuldb.com
https://vuldb.com/cve/CVE-2026-91848
vuldb.com
https://vuldb.com/submit/933701
vuldb.com
https://vuldb.com/vuln/404076
vuldb.com
https://vuldb.com/vuln/404076/cti
More from WuzhiCMS
9.8
CVE-2023-52064
Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php
9.8
CVE-2023-46482
SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in the…
9.8
CVE-2020-20413
SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in admin/content.php
9.8
CVE-2021-41654
SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php
9.8
CVE-2022-27431
Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php