CVE-2026-40330 | Masa CMS up to 7.2.9/7.3.14/7.4.9/7.5.2 beanFeed.cfc getQuery sortDirection sql injection (GHSA-56cc-gxfr-hqp8)

A vulnerability was found in Masa CMS up to 7.2.9/7.3.14/7.4.9/7.5.2 and classified as critical. The affected element is the function getQuery of the file beanFeed.cfc. Executing a manipulation of the argument sortDirection can lead to sql injection.

This vulnerability is handled as CVE-2026-40330. The attack can be executed remotely. There is not any exploit available.

It is suggested to upgrade the affected component.