Every CVE Search/ Get API key

CVE-2022-26986

SQL injection in ImpressCMS

7.2 HighPublic exploit

SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.13%Up 3.1 points since Apr 9, 2022
90%50%10%1%

What each source reports

NVD Score used 7.2

SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.

Record
CVE-2022-26986
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
8.5 HighAV:N/AC:M/Au:S/C:C/I:C/A:C
Weakness
CWE-89
Updated
2026-11-02
CVE List No score

SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.

Record
CVE-2022-26986
Updated
2026-11-02
EUVDEUVD-2022-1718 No score

SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.

Record
EUVD-2022-1718
Updated
2026-11-03
GitHub AdvisoriesGHSA-f99r-jjgr-f373 7.2

SQL injection in ImpressCMS

SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.

Record
GHSA-f99r-jjgr-f373
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSVGHSA-f99r-jjgr-f373 7.2

SQL injection in ImpressCMS

SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.

Record
GHSA-f99r-jjgr-f373
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSV No score

SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.

Record
CVE-2022-26986
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
impresscms/impresscms
Packagist
through 1.4.3 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBImpressCMS v1.4.3 - Authenticated SQL Injection2023-03-25

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-26986 is a high vulnerability (CVSS 7.2) in Impresscms, published April 5, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.13%, the 90th percentile. No source names a fixed version.

References

MoveEnter Open