CVE-2026-68000

Name of the Vulnerable Software and Affected Versions MCMS versions prior to 6.2.1

Description The front-end interface '/cms/category/list' is susceptible to SQL injection. The size parameter is directly concatenated into the LIMIT clause of a SQL query via FreeMarker ${size} without proper parameterization or binding. Although the SqlInjectionUtil function uses regular expression blacklist filtering, it fails to include keywords such as CREATE, TABLE, SET, PREPARE, and EXECUTE, which allows the filter to be bypassed. This enables unauthenticated attackers to execute stacked SQL statements.

Recommendations Update MCMS to a version newer than 6.2.0. As a temporary mitigation, restrict access to the '/cms/category/list' endpoint or avoid using the size parameter until the software is updated.