PT-2026-3369 · Xiweicheng · Xiweicheng Tms

Youran · Publicado 2026-01-17 · Atualizado 2026-03-08 · CVE-2026-1062

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions xiweicheng TMS versions up to 2.28.0

Description A flaw exists in xiweicheng TMS that allows for server-side request forgery. The issue is related to the Summary function within the src/main/java/com/lhjz/portal/util/HtmlUtil.java file. Manipulation of the url argument can trigger the flaw, potentially allowing for remote attacks. The exploit for this issue has been published.

Recommendations Versions prior to 2.28.0 should be used. As a temporary workaround, consider restricting or disabling the use of the Summary function until a patch is available.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-1062

Produtos afetados

Xiweicheng Tms

Referências · 11

• 🔥 https://github.com/bkglfpp/CVE-md/blob/main/%E5%95%86%E6%88%B7%E5%95%86%E5%9F%8E%E2%80%94%E5%95%86%E5%9F%8E%E5%BC%80%E5%8F%91tms/SSRF%EF%BC%882%EF%BC%89.md · Exploit
• 🔥 https://github.com/bkglfpp/CVE-md/blob/main/%E5%95%86%E6%88%B7%E5%95%86%E5%9F%8E%E2%80%94%E5%95%86%E5%9F%8E%E5%BC%80%E5%8F%91tms/SSRF%EF%BC%881%EF%BC%89.md · Exploit
• https://vuldb.com/?ctiid.341630 · Nota
• https://vuldb.com/?submit.731241 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1062 · Nota de Segurança
• https://t.me/cveNotify/154646 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2012669647095841092 · Publicação no Twitter
• https://vuldb.com/?submit.731242 · Nota
• https://twitter.com/dailycve/status/2030484726268428436 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-1062 · Aviso do Fabricante
• https://vuldb.com/?id.341630 · Nota