CVE-2026-94110 QCMS CVE debrief

Who should care

Defenders responsible for QCMS Content Detail Page and sql injection vulnerability management should assess exposure and prioritize verification and remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure, assess attack feasibility, and prioritize remediation of the sql injection vulnerability in QCMS Content Detail Page.

Why it matters

CVE-2026-94110 is a sql injection vulnerability in QCMS Content Detail Page that requires verification of exposure and prioritization of remediation.

• Verify QCMS Content Detail Page exposure to sql injection attacks
• Assess feasibility of remote sql injection attacks on QCMS
• Prioritize remediation of sql injection vulnerability in QCMS Content Detail Page
• Monitor for potential sql injection attacks on QCMS Content Detail Page

Technical summary

The vulnerability affects the function self_Tmp in the library Lib/Config/Controllers.php of the component Content Detail Page in QCMS up to 6.0.6. The attack may be performed from remote and requires manipulation of the argument ID to lead to sql injection. The vulnerability has a CVSS score of 5.5 and a severity of MEDIUM. Defenders should prioritize verifying exposure of QCMS Content Detail Page and assessing the feasibility of sql injection attacks. Router uses raw REQUEST_URI without URL decoding, so payloads must contain literal spaces.

Defensive priority

Defenders should prioritize verifying exposure of QCMS Content Detail Page and assessing the feasibility of sql injection attacks.

Recommended defensive actions

• Verify QCMS Content Detail Page exposure and assess sql injection attack feasibility
• Review and update QCMS to version 6.0.7 or later if available
• Monitor for potential sql injection attacks on QCMS Content Detail Page
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.5 and severity of MEDIUM. However, the vendor's response to the disclosure was limited to profanity. The vulnerability affects QCMS up to 6.0.6, and defenders should verify exposure and assess the feasibility of sql injection attacks. The CVE Program and NVD provide official records and assessments of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.