Description
MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).
Published: 2026-09-22
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an unrestricted SQL injection in the PageAction.verify endpoint of MCMS. Attackers can inject arbitrary SQL through the GET parameters of /ms/mdiy/page/verify.do, enabling them to read, modify, or delete data stored in the database. This is a classic injection flaw (CWE-89).

Affected Systems

MCMS releases 6.1.1 through 6.2.1 are affected. No specific vendor or product lineage was listed in the CNA data, but any installation using those versions of MCMS is vulnerable. The vulnerable endpoint is GET /ms/mdiy/page/verify.do.

Risk and Exploitability

The CVSS score is 9.8, indicating a critical severity. The EPSS is less than 1% and the issue is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet. However, the flaw is an unauthenticated SQL injection in a GET endpoint that can be exercised over the network if the service is exposed. Attackers can craft malicious URLs to inject SQL without authentication, so the inherent risk of data compromise remains high, despite the low exploitation probability.

Generated by OpenCVE AI on September 26, 2026 at 06:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade MCMS to a version that removes the vulnerable endpoint or apply a vendor‑issued patch if available.
  • Implement input validation and proper parameter binding for all query parameters received by the /ms/mdiy/page/verify.do endpoint to eliminate executable SQL injection vectors.
  • Restrict network access to the /ms/mdiy/page/verify.do endpoint, enforcing authentication or firewall rules to limit exposure to authorized users only.

Generated by OpenCVE AI on September 26, 2026 at 06:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 07:00:00 +0000

Type Values Removed Values Added
Title Unrestricted SQL Injection in MCMS Page Action Endpoint

Sat, 26 Sep 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
First Time appeared Mcms
Mcms mcms
Vendors & Products Mcms
Mcms mcms

Tue, 22 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Title Unrestricted SQL Injection in MCMS Page Action Endpoint
Weaknesses CWE-89

Tue, 22 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
Description MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).
References

Subscriptions

Mcms Mcms
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-25T23:22:37.694Z

Reserved: 2026-09-10T00:00:00.000Z

Link: CVE-2026-88414

cve-icon Vulnrichment

Updated: 2026-09-25T23:21:59.879Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-22T19:16:55.207

Modified: 2026-09-26T00:16:37.643

Link: CVE-2026-88414

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T06:45:06Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')