PT-2026-55785 · Hanwang · E-Face General Management Platform

Bigbrother_Man · Publicado 2026-07-05 · Atualizado 2026-07-05 · CVE-2026-14737

NVD

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

A vulnerability was identified in Hanwang e-Face General Management Platform 6.3.5.4. This impacts an unknown function of the file /sysAuthStr/querySysAuthStr.do. The manipulation of the argument order leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

Exploit

Correção

Special Elements Injection

SQL injection

Enumeração de Fraquezas

CWE-74

CWE-89

Identificadores relacionados

CVE-2026-14737

Produtos afetados

E-Face General Management Platform

Referências · 6

• 🔥 https://ucn9h68n9289.feishu.cn/docx/RWItdiw5Go02UsxHxgNcMWBqnJc?from=from_copylink · Exploit
• https://vuldb.com/submit/848640 · Nota
• https://vuldb.com/cve/CVE-2026-14737 · Nota
• https://vuldb.com/vuln/376320 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-14737 · Nota de Segurança
• https://vuldb.com/vuln/376320/cti · Nota