CVE-2026-7435 is a SQL injection vulnerability affecting SSCMS v7.4.0. The vulnerability arises because the queryString attribute in the stl:sqlContent tag is passed directly to database execution without parameterization or sanitization. Attackers can exploit this by sending crafted encrypted payloads to the /api/stl/actions/dynamic endpoint, enabling execution of arbitrary SQL statements. This can result in unauthorized access to the database, disclosure of sensitive data, bypassing authentication mechanisms, modification of data, or complete compromise of the database. The CVSS 4.0 base score is 8.6, indicating a high severity vulnerability. There is no vendor advisory or patch available, and no known exploits in the wild have been reported.

Successful exploitation allows attackers with high privileges to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data access, data leakage, bypassing authentication controls, modification or deletion of data, and potentially full database compromise. The vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/stl/actions/dynamic endpoint to trusted users only, and monitor for suspicious activity. Avoid exposing the vulnerable endpoint publicly and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting this endpoint.