A stored SQL injection flaw exists in the cms_content tag of ChestnutCMS version 1.5.10. By manipulating the content parameter through the admin backend, an attacker can inject arbitrary SQL into the query executed when the template renders. This can lead to unauthorized data disclosure, modification, or deletion within the CMS database. The weakness is a classic unvalidated input leading to injection, identified as CWE-89.

The vulnerability affects installations of ChestnutCMS version 1.5.10. Administrators who can edit the cms_content tag in the back‑end are potentially able to exploit the flaw.

The EPSS score is not available and the defect is not listed in the CISA KEV catalog, so the documented exploitation likelihood is unknown. However, the risk remains significant because the flaw allows direct manipulation of database queries. The attack likely requires access to the admin backend, so any compromised credentials or weak permission settings increase the chance of exploitation.