PT-2026-4836 · Hisense+1 · Hisense Transtech Smart Bus Management System+1

Jiefengliang · Publicado 2026-01-26 · Atualizado 2026-01-27 · CVE-2026-1449

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Hisense TransTech Smart Bus Management System versions prior to 20260114

Description A flaw exists in the Hisense TransTech Smart Bus Management System. A manipulation of the key argument within the Page Load function of the YZSoft/Forms/XForm/BM/BusComManagement/TireMng.aspx file can lead to SQL injection. This issue is potentially exploitable remotely. The exploit has been published.

Recommendations Versions prior to 20260114 should avoid using the key argument in the Page Load function of the YZSoft/Forms/XForm/BM/BusComManagement/TireMng.aspx file.

Exploit

Correção

SQL injection

Special Elements Injection

Enumeração de Fraquezas

CWE-89

CWE-74

Identificadores relacionados

CVE-2026-1449

Produtos afetados

Hisense Transtech Smart Bus Management System

Yzsoft Forms

Referências · 8

• 🔥 https://github.com/master-abc/cve/issues/15 · Exploit
• https://vuldb.com/?id.342881 · Nota
• https://t.me/cveNotify/149938 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2015934136629014934 · Publicação no Twitter
• https://t.me/CVEtracker/43028 · Publicação no Telegram
• https://vuldb.com/?submit.737032 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1449 · Nota de Segurança
• https://vuldb.com/?ctiid.342881 · Nota