CVE-2026-1130

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A flaw has been found in Yonyou KSOA 9.0. This issue affects some unknown processing of the file /worksheet/worksadd_plan.jsp of the component HTTP GET Parameter Handler. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-89

Affected software

VendorProductVersions
YonyouKSOA9.0

References

Timeline

Published
Jan 19, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-113004.3Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a cCVE-2026-1130008.8Information leak in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML pCVE-2026-1130018.8Incorrect authorization in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a craftCVE-2026-1130026.5Incorrect authorization in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineeCVE-2026-1130038.8Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside theCVE-2026-1130048.8Type confusion in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted fiCVE-2026-1130058.8Missing authorization in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procesCVE-2026-1130068.8Incorrect authorization in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictionsCVE-2026-1130079.6Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions CVE-2026-1130088.8Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pCVE-2026-1130098.8UI misrepresentation in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineerinCVE-2026-113018.8Inappropriate implementation in LiveCaption in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of
CVE-2026-1130: Critical severity, CVSS 9.8 | Vulnix