CVE-2022-26986

CVE-2022-26986 is an authenticated SQL Injection vulnerability affecting ImpressCMS 1.4.3 and earlier versions. This flaw allows a remote attacker, with high privileges, to read and modify sensitive database information, and potentially upload a malicious web shell to compromise the entire system if misconfigured. Rated with a CVSS score of 7.2 (HIGH), it presents a significant risk due to its low attack complexity and high impact on confidentiality, integrity, and availability. While not listed on the KEV catalog, an exploit (EDB-51056) is publicly available, though there is no evidence of active exploitation or significant community discussion.