CVE-2026-6629

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A vulnerability has been found in Metasoft 美特软件 MetaCRM up to 6.4.0. This vulnerability affects the function Statement.executeUpdate of the file sql.jsp of the component Interface. Such manipulation of the argument sql leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Apr 20, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-662966.1Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the CVE-2026-662978.0Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in livebook-dev livebook allows commaCVE-2026-662988.8Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard CVE-2026-662995.3Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M2CVE-2026-66308.8A vulnerability was found in Tenda F451 1.0.0.7_cn_svn7958. This issue affects the function fromGstDhcpSetSer of the file /goform/GstDhcpSetCVE-2026-663005.0SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can injeCVE-2026-663016.5Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to discloseCVE-2026-663029.8External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.CVE-2026-663036.5Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.CVE-2026-663047.5Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.CVE-2026-663057.1Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.CVE-2026-663066.5Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information o