What’s Vulnerable › Vulnerabilities

CVE-2026-36962

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-11 · updated 2026-06-17
• Weakness: CWE-89

Description

SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve unauthorized administrative access, and potentially gain remote code execution by writing malicious files to the server's file system via the keyword parameter in the /index/controller/Search.php endpoint.

References

• https://gitee.com/dameng100/muucmf
• https://thinhneee.github.io/posts/muucmf-sqli/
• https://thinhneee.github.io/posts/muucmf-sqli/

Get alerted when CVE-2026-36962 or the next vulnerability affects your stack