CVE-2026-6978

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6978", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-24T18:52:18.511Z", "datePublished": "2026-04-25T11:45:14.900Z", "dateUpdated": "2026-04-27T13:43:45.138Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-25T11:45:14.900Z"}, "title": "JiZhiCMS addcache.html htmlspecialchars_decode sql injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "SQL Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "n/a", "product": "JiZhiCMS", "versions": [{"version": "2.5.0", "status": "affected"}, {"version": "2.5.1", "status": "affected"}, {"version": "2.5.2", "status": "affected"}, {"version": "2.5.3", "status": "affected"}, {"version": "2.5.4", "status": "affected"}, {"version": "2.5.5", "status": "affected"}, {"version": "2.5.6", "status": "affected"}], "cpes": ["cpe:2.3:a:jizhicms:jizhicms:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in JiZhiCMS up to 2.5.6. The impacted element is the function htmlspecialchars_decode of the file /index.php/admins/Sys/addcache.html. The manipulation of the argument sqls results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-24T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-24T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-24T20:57:25.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "qingyunsec (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359521", "name": "VDB-359521 | JiZhiCMS addcache.html htmlspecialchars_decode sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359521/cti", "name": "VDB-359521 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/795348", "name": "Submit #795348 | JizhiCMS JiZhiCMS v2.5.6 SQL injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/qingyun985/Cyber-Security/issues/4", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T13:43:29.475339Z", "id": "CVE-2026-6978", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:43:45.138Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6978", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T13:43:29.475339Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:43:38.255Z"}}], "cna": {"title": "JiZhiCMS addcache.html htmlspecialchars_decode sql injection", "credits": [{"lang": "en", "type": "reporter", "value": "qingyunsec (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:jizhicms:jizhicms:*:*:*:*:*:*:*:*"], "vendor": "n/a", "product": "JiZhiCMS", "versions": [{"status": "affected", "version": "2.5.0"}, {"status": "affected", "version": "2.5.1"}, {"status": "affected", "version": "2.5.2"}, {"status": "affected", "version": "2.5.3"}, {"status": "affected", "version": "2.5.4"}, {"status": "affected", "version": "2.5.5"}, {"status": "affected", "version": "2.5.6"}]}], "timeline": [{"lang": "en", "time": "2026-04-24T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-24T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-24T20:57:25.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359521", "name": "VDB-359521 | JiZhiCMS addcache.html htmlspecialchars_decode sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359521/cti", "name": "VDB-359521 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/795348", "name": "Submit #795348 | JizhiCMS JiZhiCMS v2.5.6 SQL injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/qingyun985/Cyber-Security/issues/4", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in JiZhiCMS up to 2.5.6. The impacted element is the function htmlspecialchars_decode of the file /index.php/admins/Sys/addcache.html. The manipulation of the argument sqls results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "SQL Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-25T11:45:14.900Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6978", "state": "PUBLISHED", "dateUpdated": "2026-04-27T13:43:45.138Z", "dateReserved": "2026-04-24T18:52:18.511Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-25T11:45:14.900Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:jizhicms:jizhicms:*:*:*:*:*:*:*:*"], "product": "JiZhiCMS", "vendor": "n/a", "versions": [{"status": "affected", "version": "2.5.0"}, {"status": "affected", "version": "2.5.1"}, {"status": "affected", "version": "2.5.2"}, {"status": "affected", "version": "2.5.3"}, {"status": "affected", "version": "2.5.4"}, {"status": "affected", "version": "2.5.5"}, {"status": "affected", "version": "2.5.6"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in JiZhiCMS up to 2.5.6. The impacted element is the function htmlspecialchars_decode of the file /index.php/admins/Sys/addcache.html. The manipulation of the argument sqls results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "id": "CVE-2026-6978", "lastModified": "2026-06-17T11:01:34.700", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6978", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T13:43:29.475339Z", "version": "2.0.3"}}]}, "published": "2026-04-25T12:15:59.237", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/qingyun985/Cyber-Security/issues/4"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/795348"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359521"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359521/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.5.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.5.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.5.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.5.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.5.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.5.6"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "JiZhiCMS", "source": "cna", "vendor": "n/a"}, "product": "jizhicms", "vendor": "jizhicms"}], "analysis": {"en": {"generated_at": "2026-04-28T13:30:22.773809+00:00", "value": {"mitigation_remediation": ["Restrict access to the /index.php/admins/Sys/addcache.html administrative endpoint to trusted IP ranges or protect it with strong authentication, ideally multi\u2011factor.", "Implement proper input validation and replace the current htmlspecialchars_decode usage with parameterized SQL queries or stored procedures that do not interpolate user data.", "Deploy a Web Application Firewall or intrusion detection rules to detect and block suspicious SQL payloads targeting the sqls parameter, and monitor server logs for abnormal query activity."], "summary": {"action": "Assess", "impact": "Remote SQL Injection"}, "threat_synthesis": {"affected_systems": "All JiZhiCMS installations running any release version through 2.5.6 are potentially affected. The vulnerable code resides in the addcache.html subsystem of the administrative interface. No other vendors or product versions are listed in the CNA data.", "description_and_impact": "A flaw exists in JiZhiCMS versions up to 2.5.6 within the htmlspecialchars_decode function in /index.php/admins/Sys/addcache.html, where the sqls argument is not properly sanitized, enabling the injection of arbitrary SQL statements. This leads to execution of malicious database commands, allowing an attacker to retrieve, modify, or delete data, thereby compromising database confidentiality, integrity, and availability. The attack does not depend on any session state or CSRF token, enabling it to be triggered by a simple HTTP request to the vulnerable endpoint.", "risk_and_exploitability": "The CVSS score of 5.1 indicates medium severity, while the EPSS score of less than 1% reflects a low probability of exploitation in the wild. The vulnerability is not catalogued in the CISA KEV list. Because the flaw is remotely exploitable via the sqls parameter and a public exploit exists, an attacker could gain unauthorized database access if the compromised CMS instance is exposed to the internet and proper access controls are not in place."}}}}, "created": "2026-04-27T20:15:12.102180+00:00", "updated": "2026-04-28T13:30:32.098830+00:00", "vendors": ["jizhicms", "jizhicms$PRODUCT$jizhicms"]}