CVE-2026-1105 is a remote SQL injection in EasyCMS, scored 7.3 (high) by NVD. The flaw sits in /UserAction.class.php and is reached through the _order argument. The vendor was contacted early and did not respond. The record names no fixed release, so reduce exposure now and watch for a patch.
What's affected
EasyCMS versions up to 1.6.
The record says an exploit has been published, so assume that anyone scanning for this product can find the weak spot. It does not say the flaw is exploited in the wild, and it is not marked as a CISA Known Exploited Vulnerability.
How to check if you're exposed
Start with inventory. Find every host that runs EasyCMS, including small installs that sit outside the main asset list. Then confirm whether /UserAction.class.php is reachable, and from where.
Review web server access logs for requests to /UserAction.class.php and look for _order values with quotes, SQL keywords or unusually long strings. Odd requests are a reason to check the database for unexpected reads or changes.
A dependency scan will not see this finding, because the vulnerable code is the product itself and not a library. Track it as a product risk until the vendor ships a fix or you retire the product.
What to do now
- List every deployment of EasyCMS and note which are reachable from the internet.
- Restrict access to /UserAction.class.php and the admin area at the network layer with an allow list, VPN or authenticated reverse proxy.
- Add a web application firewall rule that blocks SQL metacharacters on the affected argument, as a stopgap only.
- Give the application's database account the least privilege it needs, with no file or administrative rights.
- Review logs since publication on 2026-01-18 and rotate credentials stored on the host if you see suspicious activity.
- Plan to patch or replace the product. If the vendor stays silent, migration is the lasting fix.
Why it matters
The weakness classes are CWE-74 (injection) and CWE-89 (SQL injection).
Input from the request ends up inside a database query without being kept apart from the query structure. Parameterized queries remove this class of bug and cost little when used from the start. An ORDER BY value is a common place for this mistake, because developers assume sort fields are harmless and pass them straight into the query.
The vendor silence matters as much as the bug. When a project does not answer a disclosure, defenders cannot count on a patch, so the practical choices are to isolate the product or replace it. You can also run the free in-browser dependency scan or browse the Gold directory to see where a package or product shows up in your stack.
Quick check
Is there a patch?
The record names no fixed version and says the vendor did not respond. Check the vendor site and the linked report for news, and apply mitigations in the meantime.
Sources
Last reviewed: 19 October 2026.
