PT-2026-3367 · Unknown · Feminer Wms

Wangchaoxing · Published 2026-01-17 · Updated 2026-02-06 · CVE-2026-1059

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FeMiner wms versions prior to 9cad1f1b179a98b9547fd003c23b07c7594775fa

Description A security issue exists in FeMiner wms. The manipulation of the Username argument in the file /src/chkuser.php can lead to SQL injection. This attack can be carried out remotely. The exploit has been publicly disclosed.

Recommendations Update FeMiner wms to version 9cad1f1b179a98b9547fd003c23b07c7594775fa or later.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-1059

Affected Products

Feminer Wms

References · 11

• 🔥 https://github.com/wangchaoxing/CVE/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2026-1059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1059 · Security Note
• https://twitter.com/cracbot/status/2014292004445040675 · Twitter Post
• https://vuldb.com/?id.341628 · Note
• https://vuldb.com/?submit.731236 · Note
• https://t.me/cveNotify/149447 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2012612163660025929 · Twitter Post
• https://vuldb.com/?ctiid.341628 · Note
• https://twitter.com/CVEnew/status/2012669649314542054 · Twitter Post
• https://t.me/cveNotify/151200 · Telegram Post