CVE-2026-3200

Description

A vulnerability was identified in z-9527 admin 1.0/2.0. The affected element is the function checkName/register/login/getUser/getUsers of the file /server/controller/user.js. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

https://vuldb.com/?submit.758330

https://vuldb.com/?submit.758328

https://vuldb.com/?submit.758327

https://vuldb.com/?submit.758326

https://vuldb.com/?submit.758325

https://vuldb.com/?id.347772

https://vuldb.com/?ctiid.347772

https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-2

https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-1

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS