CVE-2026-30637 describes an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the AnnounContent of /admin/read.php within OTCMS V7.66 and earlier versions. Rated High with a CVSSv3.1 score of 7.5, this flaw allows remote attackers to craft HTTP requests to internal services or external servers with low attack complexity and no user interaction, primarily leading to high confidentiality impact. There is currently no evidence of active exploitation, nor are public exploit modules available in Metasploit, Nuclei, or ExploitDB. Community discussion is minimal with only two mentions, and its very low EPSS score suggests a low probability of exploitation in the wild, despite a moderate FAUCET Risk Score of 48.0.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 7.66CPE matchmatch criteria | cpe:2.3:a:otcms:otcms:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.