PT-2026-22007 · Unknown · Z-9527 Admin

Vuldb · Published 2026-02-25 · Updated 2026-02-26 · CVE-2026-3200

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions z-9527 admin versions 1.0 through 2.0

Description A SQL injection issue exists in z-9527 admin. The issue is located in the checkName, register, login, getUser, and getUsers functions within the /server/controller/user.js file. This allows for remote exploitation. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Versions prior to 1.0 and 2.0 are not affected. Versions 1.0 and 2.0: Address the SQL injection issue in the checkName, register, login, getUser, and getUsers functions of the /server/controller/user.js file.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-3200

Affected Products

Z-9527 Admin

References · 13

• 🔥 https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3200 · Security Note
• https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-1 · Note
• https://twitter.com/CVEnew/status/2027099285737894371 · Twitter Post
• https://vuldb.com/?id.347772 · Note
• https://vuldb.com/?ctiid.347772 · Note
• https://twitter.com/VulmonFeeds/status/2026860356669264338 · Twitter Post
• https://vuldb.com/?submit.758325 · Note
• https://vuldb.com/?submit.758326 · Note
• https://vuldb.com/?submit.758327 · Note
• https://t.me/CVEtracker/45758 · Telegram Post
• https://vuldb.com/?submit.758328 · Note
• https://vuldb.com/?submit.758330 · Note