CVE-2026-94110
highA security vulnerability has been detected in QCMS up to 6.0.6.
A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function self_Tmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Router uses raw REQUEST_URI without URL decoding, so payloads must contain literal spaces - %20 never decodes before route parsing. The support team of the vendor was contacted early about this disclosure. Unfortunately, they responded just with profanity.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/yukino06/CVE/issues/1 cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-94110 cna@vuldb.com
- https://vuldb.com/submit/944567 cna@vuldb.com
- https://vuldb.com/vuln/408039 cna@vuldb.com
- https://vuldb.com/vuln/408039/cti cna@vuldb.com