CVE-2026-9551

HighCVSS 7.3/10Last modified Jul 23, 2026

Description

A vulnerability was identified in Das Parking Management System 停车场管理系统 6.2.0. This affects the function xp_cmdshell of the file ParkingRecord/ExportParkingRecords of the component API Endpoint. The manipulation of the argument Value leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 26, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-955125.5A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a userCVE-2026-955137.5Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.CVE-2026-955145.3Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.CVE-2026-955157.1Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.CVE-2026-955197.8A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or siCVE-2026-95527.3A security flaw has been discovered in Das Parking Management System 停车场管理系统 6.2.0. This vulnerability affects unknown code of the componentCVE-2026-955207.1A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES CVE-2026-955217.8A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro conCVE-2026-955227.6Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.CVE-2026-955236.5Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.CVE-2026-955245.3Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.CVE-2026-955256.5Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.