CVE-2026-1131

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in Yonyou KSOA 9.0. Impacted is an unknown function of the file /kmc/save_catalog.jsp of the component HTTP GET Parameter Handler. Such manipulation of the argument catalogid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jan 19, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-113107.5X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enaCVE-2026-1131008.8Use of uninitialized variable in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside tCVE-2026-1131018.8Incorrect authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer CVE-2026-1131026.5Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineeringCVE-2026-1131038.8Race condition in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and CVE-2026-1131048.8Use after free in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox viaCVE-2026-1131058.8Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proCVE-2026-1131068.8Type confusion in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain CVE-2026-1131078.8Missing authorization in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the rendeCVE-2026-1131088.8Information loss in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML CVE-2026-1131098.8Incorrect authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass sysCVE-2026-113116.5When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration gener
CVE-2026-1131: Critical severity, CVSS 9.8 | Vulnix