CVE-2026-40330

Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's handling of the sortDirection parameter. The parameter value is concatenated directly into SQL queries without sanitization or parameterization. An unauthenticated remote attacker can exploit this to extract sensitive information, modify or delete database records, or potentially achieve remote code execution on the underlying database server. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, use a WAF to block or restrict access to the beanFeed.cfc component, or deploy rules to detect SQL injection patterns targeting the sortDirection parameter.

• CWE-89

• https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-56cc-gxfr-hqp8

Published

May 5, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40324Hot Chocolate is an open-source GraphQL server. Prior to ver…9.1
• CVE-2026-40325Masa CMS is a content management system forked from Mura CMS…8.7
• CVE-2026-40326Masa CMS is a content management system forked from Mura CMS…7.1
• CVE-2026-40327Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-40328Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-40329Masa CMS is an open source content management system. In ver…9.3
• CVE-2026-40331Masa CMS is an open source content management system. In ver…9.3
• CVE-2026-40332Masa CMS is affected by an Open Redirect vulnerability due t…5.3
• CVE-2026-40333libgphoto2 is a camera access and control library. In versio…6.1
• CVE-2026-40334libgphoto2 is a camera access and control library. In versio…3.5
• CVE-2026-40335libgphoto2 is a camera access and control library. Versions …5.2
• CVE-2026-40336libgphoto2 is a camera access and control library. Versions …2.4