PT-2026-22007 · Unknown · Z-9527 Admin

Vuldb · CVE-2026-3200 · Publicado 2026-02-25 · Atualizado 2026-02-26

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions z-9527 admin versions 1.0 through 2.0

Description A SQL injection issue exists in z-9527 admin. The issue is located in the checkName, register, login, getUser, and getUsers functions within the /server/controller/user.js file. This allows for remote exploitation. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Versions prior to 1.0 and 2.0 are not affected. Versions 1.0 and 2.0: Address the SQL injection issue in the checkName, register, login, getUser, and getUsers functions of the /server/controller/user.js file.

Exploit

Correção

Special Elements Injection

SQL injection

Enumeração de Fraquezas

CWE-74

CWE-89

Identificadores relacionados

CVE-2026-3200

Produtos afetados

Z-9527 Admin

Referências · 13

• 🔥 https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-2 · Exploit
• https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-1 · Nota
• https://twitter.com/CVEnew/status/2027099285737894371 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3200 · Nota de Segurança
• https://vuldb.com/?id.347772 · Nota
• https://vuldb.com/?ctiid.347772 · Nota
• https://twitter.com/VulmonFeeds/status/2026860356669264338 · Publicação no Twitter
• https://vuldb.com/?submit.758325 · Nota
• https://vuldb.com/?submit.758326 · Nota
• https://vuldb.com/?submit.758327 · Nota
• https://t.me/CVEtracker/45758 · Publicação no Telegram
• https://vuldb.com/?submit.758328 · Nota
• https://vuldb.com/?submit.758330 · Nota