CVE-2026-36458 | THREATINT

Description

ChestnutCMS v1.5.10 has a SQL injection vulnerability. The content parameter of the cms_content tag can be manipulated in the admin backend and injected into a SQL query when the template is rendered.

PUBLISHED Reserved 2026-04-06 | Published 2026-05-07 | Updated 2026-05-08 | Assigner mitre

References

github.com/liweiyi/ChestnutCMS.git

github.com/errors11/CVE/blob/main/CVE-2026-36458.md

cve.org (CVE-2026-36458)

nvd.nist.gov (CVE-2026-36458)

Download JSON