Skip to content

Vendor

ofcms vulnerabilities

4 published CVES affecting ofcms, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
0
High
0
Medium
4
Low
0
Unscored
0
CISA KEV
0
Atom feed of ofcms alerts

Products

Latest ofcms CVEs

Newest publication first

  1. CVE-2026-10204 OFCMS JSON Query SysUserController.java query sql injection

    Published
    MediumCVSS 5.3

    A weakness has been identified in OFCMS 1.1.3. The affected element is the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SysUserController.java of the component JSON Query Interface. This manipulation causes sql injection. The attack...

  2. CVE-2026-10203 OFCMS JSON Query SystemParamController.java query sql injection

    Published
    MediumCVSS 5.3

    A security flaw has been discovered in OFCMS 1.1.3. Impacted is the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SystemParamController.java of the component JSON Query Interface. The manipulation results in sql injection. The attack...

  3. CVE-2026-10202 OFCMS JSON Query SystemDictController.java query sql injection

    Published
    MediumCVSS 5.3

    A vulnerability was identified in OFCMS 1.1.3. This issue affects the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SystemDictController.java of the component JSON Query Interface. The manipulation leads to sql injection. The attack...

  4. CVE-2026-10193 OFCMS ComnController ComnController.java query sql injection

    Published
    MediumCVSS 5.3

    A security flaw has been discovered in OFCMS up to 1.1.3. The impacted element is the function Query of the file ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\ComnController.java of the component ComnController. Performing a manipulation of the argument system.user.qu...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.