CVE-2026-40529

5.1 mediumEPSS 0.2%

CMS ALAYA provided by KANATA Limited contains an SQL injection vulnerability. Information stored in the database may be obtained or altered by an attacker with access to the administrative interface.

CVSS 4.0: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.0: 4.7CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
EPSS: 0.2% chance of exploitation in the next 30 days; higher than 5% of CVEs (scores of 2026-10-26)
CWE: CWE-89
Published: 2026-04-23
Modified: 2026-10-26
Record from: the NVD, synced 2026-10-26

References

https://jvn.jp/en/jp/JVN08026319/

Check your stack JSON