CVE-2026-4289

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This affects an unknown function of the file /rest/preSetTemplate/getRecByTemplateId. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Mar 17, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-428904.8Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron 39.2.7), the ELECTROCVE-2026-428916.5User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform CVE-2026-428937.5Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perfoCVE-2026-428957.5Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to CVE-2026-428967.8Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2026-428976.1Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attCVE-2026-428989.9Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute cCVE-2026-428997.5Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-42909.1The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST APCVE-2026-429008.1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attaCVE-2026-4290110.0Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.CVE-2026-429027.8Improper authorization in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.
CVE-2026-4289: High severity, CVSS 7.3 | Vulnix