CVE-2026-2122

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in Xiaopi Panel up to 20260126. This impacts an unknown function of the file /demo.php of the component WAF Firewall. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Xiaopi	Panel	20260126

References

https://github.com/ltranquility/CVE/issues/37Not Applicable
https://vuldb.com/?ctiid.344695Permissions Required, VDB Entry
https://vuldb.com/?id.344695Third Party Advisory, VDB Entry
https://vuldb.com/?submit.746917Third Party Advisory, VDB Entry

Timeline

Published: Feb 8, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-212217.0Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc)CVE-2026-212225.5Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2026-212237.1Improper privilege management in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally.CVE-2026-212247.8Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.CVE-2026-212267.5Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a networ CVE-2026-212279.8Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevat CVE-2026-212288.1Improper certificate validation in Azure Local allows an unauthorized attacker to execute code over a network.CVE-2026-212298.8Improper input validation in Power BI allows an authorized attacker to execute code over a network.CVE-2026-21237.8A security audit identified a privilege escalation vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions Opera CVE-2026-212317.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker CVE-2026-212327.8Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.CVE-2026-212347.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service al