Medium severity6.3NVD Advisory· Published Feb 22, 2026· Updated Apr 29, 2026
CVE-2026-2954
CVE-2026-2954
Description
A vulnerability was found in Dromara UJCMS 10.0.2. Impacted is the function importChanel of the file /api/backend/ext/import-data/import-channel of the component ImportDataController. Performing a manipulation of the argument driverClassName/url results in injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- vuldb.comnvdThird Party AdvisoryVDB Entry
- vuldb.comnvdThird Party AdvisoryVDB Entry
- vuldb.comnvdPermissions RequiredVDB Entry
- www.yuque.com/la12138/pa2fpb/gsz2l14wlz8c4nsnnvdBroken Link
News mentions
0No linked articles in our index yet.