Vulnerability details
CVE-2026-124331
Jinher OA
Jinher OA ProjectAfficheManage.aspx sql injection
CVSS 4.0
6.9Medium
Official description
A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 6.9Medium | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P |
| 7.3High | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R |
| 7.3High | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R |
| 7.5High | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Jinher | OA | C6 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://vuldb.com/vuln/432651 vdb-entrytechnical-description
- https://vuldb.com/vuln/432651/cti signaturepermissions-required
- https://vuldb.com/cve/CVE-2026-124331 third-party-advisory
- https://vuldb.com/submit/1028013 third-party-advisory
- https://github.com/wangpenglei11/Submit/issues/2 exploitissue-tracking
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-11-08
- Last updated
- 2026-11-08
- State
- Published
- Assigner (CNA)
- VulDB
Exploit prediction (EPSS)
No EPSS score has been published for this CVE yet.
Weaknesses (CWE)
- CWE-89SQL Injection
- CWE-74Injection