CVE-2026-40329

Masa CMS is an open source content management system. In versions 7.5.2 and earlier, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's processing of the sortBy parameter. The application fails to properly sanitize or parameterize this input before incorporating it into dynamic SQL statements. An unauthenticated remote attacker can execute arbitrary SQL commands against the database, potentially gaining access to sensitive data, modifying or deleting records, or escalating privileges to administrative control. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, configure WAF rules to block malicious SQL patterns in the sortBy parameter sent to beanFeed.cfc.

• CWE-89

• https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-3xpq-q494-8qq4

Published

May 5, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40323SP1 is a zero‑knowledge virtual machine that proves the corr…7.5
• CVE-2026-40324Hot Chocolate is an open-source GraphQL server. Prior to ver…9.1
• CVE-2026-40325Masa CMS is a content management system forked from Mura CMS…8.7
• CVE-2026-40326Masa CMS is a content management system forked from Mura CMS…7.1
• CVE-2026-40327Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-40328Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-40330Masa CMS is an open source content management system. In ver…9.3
• CVE-2026-40331Masa CMS is an open source content management system. In ver…9.3
• CVE-2026-40332Masa CMS is affected by an Open Redirect vulnerability due t…5.3
• CVE-2026-40333libgphoto2 is a camera access and control library. In versio…6.1
• CVE-2026-40334libgphoto2 is a camera access and control library. In versio…3.5
• CVE-2026-40335libgphoto2 is a camera access and control library. Versions …5.2