CVE-2026-91848: WuzhiCMS index.php getDataOfJson sql injection
A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson. The manipulation of the argument title/mastertable leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
WuzhiCMS versions up to and including 4.1.0 are identified as affected. The vulnerable functionality is reachable through index.php using the content/article getDataOfJson route.
What does an attacker need to exploit it?
Remote exploitation is possible, and the supplied severity vector indicates no privileges or user interaction are required. An attacker manipulates the title or master_table argument passed to the affected function.
Is public exploit code available?
Yes. The available information states that a public exploit exists and may be used.
Is a vendor fix available?
No vendor response or fix is reported in the provided information. The project was notified through an issue report but had not responded at the time of publication.