CVE-2026-7670

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/UserSel.aspx. This manipulation of the argument DeptIDList causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 2, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-767005.9Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service. SCVE-2026-767015.9A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to access sCVE-2026-767025.8A vulnerability in the operating system of HPE Networking EdgeConnect SD-WAN Gateways could allow an authenticated local attacker to cause aCVE-2026-767035.5A buffer overflow vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways that could allow CVE-2026-767045.5A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker toCVE-2026-767055.5A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could alloCVE-2026-767065.3A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtaCVE-2026-767074.3A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to view some system memory coCVE-2026-767089.8A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coCVE-2026-767099.8A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnCVE-2026-76713.7A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of theCVE-2026-767107.5A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive inform
CVE-2026-7670: High severity, CVSS 7.3 | Vulnix