CVE-2026-1132

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /kmf/edit_folder.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument folderid results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jan 19, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1132008.8Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via aCVE-2026-1132016.5Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sanCVE-2026-1132028.8Use after free in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox CVE-2026-1132038.8Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sanCVE-2026-1132048.8Use after free in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially executCVE-2026-1132058.8Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox CVE-2026-1132068.8Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox CVE-2026-1132078.8Use after free in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inCVE-2026-1132088.8Use after free in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the saCVE-2026-1132096.5Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially read memory insidCVE-2026-113216.4The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV iCVE-2026-1132108.8Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the
CVE-2026-1132: Critical severity, CVSS 9.8 | Vulnix