CVE-2026-88414

Summary

The flaw is a SQL injection vulnerability in the PageAction.verify endpoint of MCMS 6.1.1 through 6.2.1, allowing attackers to execute arbitrary SQL commands and potentially gain full control over the database.

Exploitability

Exploitation is relatively straightforward given the critical nature of the vulnerability, requiring only access to the affected endpoint via a GET request.

Blast radius

If exploited, this vulnerability could result in complete database compromise, leading to data theft, corruption, or loss.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to MCMS 6.2.2 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.