CVE-2026-2954

MEDIUM 6.3

Dromara UJCMS ImportDataController import-channel importChanel injection

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in Dromara UJCMS 10.0.2. Impacted is the function importChanel of the file /api/backend/ext/import-data/import-channel of the component ImportDataController. Performing a manipulation of the argument driverClassName/url results in injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-74 CWE-707
Vendor	dromara
Product	ujcms
Published	Feb 22, 2026
Last Updated	Feb 23, 2026

Stay Ahead of the Next One

Get instant alerts for dromara ujcms

Be the first to know when new medium vulnerabilities affecting dromara ujcms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Dromara / UJCMS

10.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/?id.347320 vuldb.com: https://vuldb.com/?ctiid.347320 vuldb.com: https://vuldb.com/?submit.755222 yuque.com: https://www.yuque.com/la12138/pa2fpb/gsz2l14wlz8c4nsn?singleDoc

Credits

🔍 Saul1213 (VulDB User)