CVE-2026-6978: JiZhiCMS addcache.html htmlspecialchars_decode sql injection
A vulnerability was detected in JiZhiCMS up to 2.5.6. The impacted element is the function htmlspecialcharsdecode of the file /index.php/admins/Sys/addcache.html. The manipulation of the argument sqls results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6978?
CVE-2026-6978 is classified as a critical SQL injection vulnerability in JiZhiCMS.
How do I fix CVE-2026-6978?
To fix CVE-2026-6978, upgrade JiZhiCMS to version 2.5.7 or later, which addresses the vulnerability.
What versions of JiZhiCMS are affected by CVE-2026-6978?
CVE-2026-6978 affects JiZhiCMS versions up to and including 2.5.6.
What type of vulnerability is CVE-2026-6978?
CVE-2026-6978 is an SQL injection vulnerability that allows attackers to manipulate database queries.
Where in JiZhiCMS is CVE-2026-6978 located?
CVE-2026-6978 is found in the function htmlspecialchars_decode in the file /index.php/admins/Sys/addcache.html.