Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A security flaw has been discovered in EasyCMS up to 1.6. The impacted element is an unknown function of the file /RbacuserAction.class.php of the component Request Parameter Handler. The manipulation of the argument _order results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-3786 A security flaw has been discovered in EasyCMS up to 1.6. The impacted element is an unknown function of the file /RbacuserAction.class.php of the component Request Par… https://www.cve.org/CVERecord?id=CVE-2026-3786
Post summary
A brief announcement identifies CVE‑2026‑3786 in EasyCMS, but provides no PoC, exploit details, active exploitation evidence, patch information, or in‑depth technical data.
CVE-2026-3786 SQL Injection in EasyCMS 1.6 via _order Parameter in RbacuserAction https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3786
Post summary
The entry announces CVE-2026-3786, indicating an SQL injection flaw in EasyCMS 1.6 via the _order parameter, but provides no proof-of-concept, exploit code, patch, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | easycms | easycms | - | - | - |