CVE-2026-7435 is a SQL injection vulnerability affecting SSCMS version 7.4.0. The vulnerability arises because the queryString attribute of the stl:sqlContent tag is passed directly to database execution without parameterization or sanitization. Attackers can exploit this by submitting encrypted payloads to the /api/stl/actions/dynamic endpoint, enabling execution of arbitrary SQL statements. This can result in unauthorized access to the database, data leakage, bypassing authentication controls, modification of data, or complete compromise of the database. The CVSS 4.0 base score is 8.6, reflecting high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official patch or vendor remediation level is currently documented.

Exploitation of this vulnerability can lead to unauthorized database access, disclosure of sensitive data, bypass of authentication mechanisms, unauthorized data modification, and potentially full compromise of the backend database. This poses a significant risk to confidentiality, integrity, and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/stl/actions/dynamic endpoint and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable SSCMS version publicly and consider implementing web application firewall (WAF) rules to detect and block SQL injection payloads targeting this endpoint.