Approved changes feed: RSS · Atom
cpe:2.3:a:siteserver:sscms:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Siteserver (55b1d1a5-0491-5340-8f59-af2803042467) |
|---|---|
| Product | Sscms (08ff44ea-ed22-59a6-8d45-cbd735602431) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-7435 |
vulnerable | 2026-06-08 08:08:57.226962 |
SSCMS v7.4.0 SQL Injection via stl:sqlContent queryString
HIGH (7.2)
SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without parameterization or sanitization. Attackers can craft encrypted payloads submitted to the /api/stl/actions/dynamic endpoint to execute arbitrary SQL statements, leading to unauthorized database access, data disclosure, authentication bypass, data modification, or complete database compromise.
Published: 2026-04-30T20:09:17.935Z
Updated: 2026-07-28T01:50:03.577Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-7429 |
vulnerable | 2026-06-08 08:08:57.214021 |
SSCMS v7.4.0 Reflected Cross-Site Scripting via STL Processing
MEDIUM (4.6)
SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by crafting malicious STL template payloads that are decrypted and returned without proper sanitization. Attackers can exploit improper output encoding in the /api/stl/actions/dynamic endpoint to inject executable JavaScript into JSON responses, leading to session hijacking, phishing attacks, and unauthorized actions performed on behalf of users.
Published: 2026-04-30T19:45:03.364Z
Updated: 2026-07-28T01:50:02.873Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.