PT-2026-3367 · Unknown · Feminer Wms

Wangchaoxing · Publicado 2026-01-17 · Atualizado 2026-02-06 · CVE-2026-1059

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FeMiner wms versions prior to 9cad1f1b179a98b9547fd003c23b07c7594775fa

Description A security issue exists in FeMiner wms. The manipulation of the Username argument in the file /src/chkuser.php can lead to SQL injection. This attack can be carried out remotely. The exploit has been publicly disclosed.

Recommendations Update FeMiner wms to version 9cad1f1b179a98b9547fd003c23b07c7594775fa or later.

Exploit

Correção

SQL injection

Special Elements Injection

Enumeração de Fraquezas

CWE-89

CWE-74

Identificadores relacionados

CVE-2026-1059

Produtos afetados

Feminer Wms

Referências · 11

• 🔥 https://github.com/wangchaoxing/CVE/issues/1 · Exploit
• https://twitter.com/cracbot/status/2014292004445040675 · Publicação no Twitter
• https://vuldb.com/?id.341628 · Nota
• https://osv.dev/vulnerability/CVE-2026-1059 · Aviso do Fabricante
• https://vuldb.com/?submit.731236 · Nota
• https://t.me/cveNotify/149447 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2012612163660025929 · Publicação no Twitter
• https://vuldb.com/?ctiid.341628 · Nota
• https://twitter.com/CVEnew/status/2012669649314542054 · Publicação no Twitter
• https://t.me/cveNotify/151200 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-1059 · Nota de Segurança