A stored SQL injection flaw exists in the cms_content tag of ChestnutCMS version 1.5.10. Manipulating the content parameter through the admin backend allows an attacker to inject arbitrary SQL into the query that executes when the template is rendered. This can lead to unauthorized disclosure, modification, or deletion of data within the CMS database, as the vulnerability stems from unvalidated input that is directly concatenated into SQL statements, reflecting CWE-94.

The vulnerability impacts installations of ChestnutCMS version 1.5.10. Users who have permission to edit the cms_content tag in the admin area are the ones who can trigger the injection; other users without such rights are unaffected.

The EPSS score is < 1% and the issue is not listed in CISA's KEV catalog, indicating that documented exploitation is scarce. Nevertheless, the flaw provides direct SQL injection capabilities, so the potential for database compromise remains high if an attacker gains admin access or if credentials are weak. The attack vector is inferred to require admin‑level access to the cms_content tag; disclosure or exploitation from external sources is unlikely without first compromising the backend.