CVE-2026-40329 | Masa CMS up to 7.2.9/7.3.14/7.4.9/7.5.2 beanFeed.cfc getQuery sortBy sql injection (GHSA-3xpq-q494-8qq4)

A vulnerability was found in Masa CMS up to 7.2.9/7.3.14/7.4.9/7.5.2. It has been classified as critical. The impacted element is the function getQuery of the file beanFeed.cfc. The manipulation of the argument sortBy leads to sql injection.

This vulnerability is uniquely identified as CVE-2026-40329. The attack is possible to be carried out remotely. No exploit exists.

Upgrading the affected component is recommended.