CVE-2026-40330
A critical SQL injection flaw exists in Masa CMS’s beanFeed.cfc component. The flaw allows an unauthenticated attacker to inject arbitrary SQL through the sortDirection parameter, potentially reading, modifying, or deleting database data and even executing code on the database server.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Masa CMS versions 7.2.0‑7.2.9, 7.3.0‑7.3.14, 7.4.0‑7.4.9, and 7.5.0‑7.5.2. Site owners running these releases are at risk.
Real-world impact
An attacker could pull confidential data, alter or erase records, or run malicious commands on the database, compromising the integrity and confidentiality of the site’s information.
Why this severity
The CVSS score of 9.3 reflects the vulnerability’s high impact on confidentiality, integrity, and availability, combined with its low attack complexity, lack of required authentication, and no user interaction.
What to do about it
- 01Upgrade Masa CMS to a fixed version (7.2.10 or later, 7.3.15 or later, 7.4.10 or later, or 7.5.3 or later).
- 02Restart the web server or application to apply the changes.
- ›Use a WAF to block or restrict access to the beanFeed.cfc component.
- ›Deploy rules to detect SQL injection patterns targeting the sortDirection parameter.
NVD-referenced vendor advisory
Timeline
- May 5, 2026 · May 5, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.