CVE-2026-2954

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-2954

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2954.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-2954

Published

2026-02-22T15:02:17.390Z

Modified

2026-07-15T01:49:22.381252286Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Dromara UJCMS ImportDataController import-channel importChanel injection

Details

A vulnerability was found in Dromara UJCMS 10.0.2. Impacted is the function importChanel of the file /api/backend/ext/import-data/import-channel of the component ImportDataController. Performing a manipulation of the argument driverClassName/url results in injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2954.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "10.0.2"
                },
                {
                    "last_affected": "10.0.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-707",
        "CWE-74"
    ]
}

References

Affected packages

Git / github.com/dromara/ujcms

Affected ranges

Type

GIT

Repo

https://github.com/dromara/ujcms

Events

Introduced

b6ff8dab056aa27a0ea356f3f0519c472c2473b1

Last affected

b6ff8dab056aa27a0ea356f3f0519c472c2473b1

Database specific

{
    "cpe": "cpe:2.3:a:ujcms:ujcms:10.0.2:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "10.0.2"
        },
        {
            "last_affected": "10.0.2"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

10.*

10.0.2

v10.*

v10.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2954.json"