SQL Injection Vulnerability in WuzhiCMS Affected Product
CVE-2026-91848

6.9MEDIUM

Key Information:

Vendor: WuzhiCMS
Status: Wuzhicms
Vendor: CVE Published:; 15 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-91848?

A security flaw in WuzhiCMS versions up to 4.1.0 allows for SQL injection through the function article::getDataOfJson. The vulnerability arises from improper handling of the title/master_table argument in the file /index.php?m=content&f=article&v=getDataOfJson. This vulnerability poses a significant risk as it enables remote attackers to manipulate database queries, potentially leading to unauthorized data access or corruption. Although the project has been alerted about this vulnerability, there has been no official response regarding a fix. Publicly available exploits increase the urgency for users to secure their installations.

Affected Version(s)

WuzhiCMS 4.0

WuzhiCMS 4.1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-91848 - Proof of Concept