Skip to content

Product

siteserver SSCMS vulnerabilities

2 published CVES affecting siteserver SSCMS, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
0
Low
1
Unscored
0
CISA KEV
0

Latest siteserver SSCMS CVEs

Newest publication first

  1. CVE-2026-7435 SSCMS v7.4.0 SQL Injection via stl:sqlContent queryString

    Published
    HighCVSS 8.6 EPSS 0.53%

    SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without parameterization or sanitization. Attackers can craft encrypted payloads submitted to the /api/stl/actions/dynamic endpoi...

  2. CVE-2026-7429 SSCMS v7.4.0 Reflected Cross-Site Scripting via STL Processing

    Published
    LowCVSS 2.1 EPSS 0.20%

    SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by crafting malicious STL template payloads that are decrypted and returned without proper sanitization. Attackers can exploit...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.