Is CVE-2026-10203 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10203 being exploited in the wild.

How severe is CVE-2026-10203?

Medium severity, with a CVSS score of 6.3, published 1 June 2026.

Is there a fix for CVE-2026-10203?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10203 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-10203?

Check whether you run Oufu OFCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10203: Oufu OFCMS SQL injection in SystemParamController

CVE-2026-10203 · Severity: medium · CVSS 6.3 · Published 2026-06-01

OFCMS, a content management system, contains a security vulnerability in its administrative interface. An attacker with low-level access can exploit this flaw to read sensitive information from the database, such as administrator passwords. This could lead to a full takeover of the website and its underlying data.

Technologies: Oufu OFCMS. Vendors: Oufu.

Quick answers

Is CVE-2026-10203 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10203 being exploited in the wild.
How severe is CVE-2026-10203?: Medium severity, with a CVSS score of 6.3, published 1 June 2026.
Which products and versions are affected?: Oufu OFCMS 1.1.3.
Is there a fix for CVE-2026-10203?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10203 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-10203?: Check whether you run Oufu OFCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A blind SQL injection vulnerability exists in OFCMS 1.1.3 within the SystemParamController.java component. The vulnerability is located in the /admin/system/param/query.json interface, specifically within the query() method. The root cause is the improper validation of the 'field' and 'sort' parameters, which are directly concatenated into an ORDER BY clause in the backend SQL query (system.param.query). An authenticated attacker with low privileges can provide malicious SQL expressions to perform boolean-based or time-based blind injection. This allows for the extraction of sensitive database records, including user credentials. A public exploit has been released, and while the vendor was notified via a Gitee issue, no patch is currently available.

Affected products

Oufu OFCMS 1.1.3

Timeline

2026-05-07: disclosed: Issue reported on Gitee repository
2026-06-01: advisory: CVE published by VulDB/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.