CVE-2026-111658: SSCMS 0 through 7.4.0

Affected technology

SSCMS · 0 through 7.4.0
SiteServer

Description’s affected range: through 7.4.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · No user interaction required

What an attacker can do

Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation. Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality and integrity impact as low; availability impact as none.