CVE-2026-91848

Name of the Vulnerable Software and Affected Versions WuzhiCMS versions prior to 4.1.1

Description A SQL injection issue exists in the article::getDataOfJson() function within the '/index.php?m=content&f=article&v=getDataOfJson' endpoint. This occurs when the title/master table argument is manipulated, allowing for remote exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/index.php?m=content&f=article&v=getDataOfJson' endpoint or avoid using the title/master table argument.