CVE-2026-7435 describes a SQL injection vulnerability in siteserver SSCMS version 7.4.0. The vulnerability exists because the queryString attribute of the stl:sqlContent tag is passed directly to database execution without parameterization or sanitization. Attackers can exploit this by submitting crafted encrypted payloads to the /api/stl/actions/dynamic endpoint, enabling execution of arbitrary SQL statements. This can result in unauthorized access to the database, data leakage, bypassing authentication mechanisms, modification of data, or complete compromise of the database. The CVSS 4.0 base score is 8.6, indicating high severity. No patch or official remediation level has been published as of now.

Successful exploitation allows attackers to execute arbitrary SQL commands on the affected SSCMS database. This can lead to unauthorized access to sensitive data, disclosure of confidential information, bypass of authentication controls, unauthorized modification of data, or complete compromise of the database integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/stl/actions/dynamic endpoint to trusted users only and monitor for suspicious activity related to this endpoint. Avoid exposing the vulnerable SSCMS version publicly where possible.