PT-2026-24843 · Xierongwkhd · Weimai-Wetapp

Zast.Ai · Published 2026-03-11 · Updated 2026-06-03 · CVE-2026-3956

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xierongwkhd weimai-wetapp versions prior to 5fe9e8225be4f73f2c5087f134aff657bdf1c6f2

Description A security issue exists in xierongwkhd weimai-wetapp. The getAdmins function within the file source-code/src/main/java/com/moke/wp/wx weimai/controller/admin/Admin AdminUserController.java is susceptible to SQL injection. Manipulating the keyword argument can trigger this issue. Remote exploitation is possible. The exploit is publicly available. The software utilizes a rolling release model, meaning specific version details for affected or updated releases are not provided. The project maintainers were notified of the problem but have not yet responded.

Recommendations Versions prior to 5fe9e8225be4f73f2c5087f134aff657bdf1c6f2: As a temporary workaround, consider restricting access to the getAdmins function until a patch is available.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-3956

Affected Products

Weimai-Wetapp

References · 10

• 🔥 https://github.com/xierongwkhd/weimai-wetapp/issues/48 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3956 · Security Note
• https://t.me/CVEtracker/47181 · Telegram Post
• https://vuldb.com/?id.350386 · Note
• https://vuldb.com/?submit.767884 · Note
• https://twitter.com/zast_ai/status/2061964554515698055 · Twitter Post
• https://vuldb.com/?ctiid.350386 · Note
• https://twitter.com/CVEnew/status/2031867639857893493 · Twitter Post
• https://twitter.com/geng_zast/status/2061971513793028517 · Twitter Post
• https://github.com/xierongwkhd/weimai-wetapp · Note