CVE-2026-10202 is a SQL injection vulnerability affecting OFCMS 1.1.3. The flaw exists in the Query function located in \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SystemDictController.java within the JSON Query Interface component. Remote attackers can exploit this vulnerability by crafting malicious input to manipulate SQL queries executed by the application. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The project was notified early but has not issued a patch or mitigation guidance. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation of this vulnerability can allow remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access, data modification, or other database-related impacts. Given the medium CVSS score and lack of vendor response, affected systems remain at risk until remediation is applied.

No official patch or remediation guidance is currently available from the vendor. Since the project has not responded or released a fix, users should consider applying temporary mitigations such as restricting access to the affected interface, implementing web application firewalls with SQL injection detection rules, or disabling the vulnerable functionality if feasible. Monitor vendor channels for updates and apply official patches once released.