CVE-2026-2821

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2821", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-19T17:17:52.448Z", "datePublished": "2026-02-20T02:32:06.771Z", "dateUpdated": "2026-02-23T10:30:19.990Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:30:19.990Z"}, "title": "Fujian Smart Integrated Management Platform System XCamera.ashx sql injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "SQL Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "Fujian", "product": "Smart Integrated Management Platform System", "versions": [{"version": "7.0", "status": "affected"}, {"version": "7.1", "status": "affected"}, {"version": "7.2", "status": "affected"}, {"version": "7.3", "status": "affected"}, {"version": "7.4", "status": "affected"}, {"version": "7.5", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Fujian Smart Integrated Management Platform System up to 7.5. Impacted is an unknown function of the file /Module/CRXT/Controller/XCamera.ashx. This manipulation of the argument ChannelName causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-19T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-19T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-22T08:50:35.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "lanmeik (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.346946", "name": "VDB-346946 | Fujian Smart Integrated Management Platform System XCamera.ashx sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.346946", "name": "VDB-346946 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.753405", "name": "Submit #753405 | Fuzhou Yinda Yunchuang Information Technology Smart Integrated Management Platform System 7.5 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/luoye197-prog/cve-yinda-sql2/blob/main/introduce", "tags": ["broken-link"]}, {"url": "https://github.com/luoye197-prog/cve-yinda-sql2/blob/main/poc.py", "tags": ["broken-link", "exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T15:32:24.231753Z", "id": "CVE-2026-2821", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:32:38.190Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2821", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T15:32:24.231753Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:32:32.734Z"}}], "cna": {"title": "Fujian Smart Integrated Management Platform System XCamera.ashx sql injection", "credits": [{"lang": "en", "type": "reporter", "value": "lanmeik (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Fujian", "product": "Smart Integrated Management Platform System", "versions": [{"status": "affected", "version": "7.0"}, {"status": "affected", "version": "7.1"}, {"status": "affected", "version": "7.2"}, {"status": "affected", "version": "7.3"}, {"status": "affected", "version": "7.4"}, {"status": "affected", "version": "7.5"}]}], "timeline": [{"lang": "en", "time": "2026-02-19T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-19T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-22T08:50:35.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.346946", "name": "VDB-346946 | Fujian Smart Integrated Management Platform System XCamera.ashx sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.346946", "name": "VDB-346946 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.753405", "name": "Submit #753405 | Fuzhou Yinda Yunchuang Information Technology Smart Integrated Management Platform System 7.5 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/luoye197-prog/cve-yinda-sql2/blob/main/introduce", "tags": ["broken-link"]}, {"url": "https://github.com/luoye197-prog/cve-yinda-sql2/blob/main/poc.py", "tags": ["broken-link", "exploit"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Fujian Smart Integrated Management Platform System up to 7.5. Impacted is an unknown function of the file /Module/CRXT/Controller/XCamera.ashx. This manipulation of the argument ChannelName causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "SQL Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:30:19.990Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2821", "state": "PUBLISHED", "dateUpdated": "2026-02-23T10:30:19.990Z", "dateReserved": "2026-02-19T17:17:52.448Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-20T02:32:06.771Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Smart Integrated Management Platform System", "vendor": "Fujian", "versions": [{"status": "affected", "version": "7.0"}, {"status": "affected", "version": "7.1"}, {"status": "affected", "version": "7.2"}, {"status": "affected", "version": "7.3"}, {"status": "affected", "version": "7.4"}, {"status": "affected", "version": "7.5"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Fujian Smart Integrated Management Platform System up to 7.5. Impacted is an unknown function of the file /Module/CRXT/Controller/XCamera.ashx. This manipulation of the argument ChannelName causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks."}, {"lang": "es", "value": "Se ha identificado una debilidad en el Sistema de Plataforma de Gesti\u00f3n Integrada Inteligente de Fujian hasta la versi\u00f3n 7.5 que afecta a una funci\u00f3n desconocida del archivo /Module/CRXT/Controller/XCamera.ashx. La manipulaci\u00f3n del argumento ChannelName provoca una inyecci\u00f3n SQL. Es posible explotar el ataque en remoto. El exploit se ha puesto a disposici\u00f3n del p\u00fablico y podr\u00eda ser utilizado para ataques."}], "id": "CVE-2026-2821", "lastModified": "2026-06-17T10:31:50.040", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2821", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T15:32:24.231753Z", "version": "2.0.3"}}]}, "published": "2026-02-20T03:16:02.137", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/luoye197-prog/cve-yinda-sql2/blob/main/introduce"}, {"source": "cna@vuldb.com", "url": "https://github.com/luoye197-prog/cve-yinda-sql2/blob/main/poc.py"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.346946"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.346946"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.753405"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.5"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Smart Integrated Management Platform System", "source": "cna", "vendor": "Fujian"}, "product": "smart_integrated_management_platform_system", "vendor": "fujian"}], "analysis": {"en": {"generated_at": "2026-04-17T17:32:29.083414+00:00", "value": {"mitigation_remediation": ["Apply the latest Fujian patch that addresses the XCamera.ashx SQL injection flaw.", "If a patch is unavailable, restrict or block external access to /Module/CRXT/Controller/XCamera.ashx using the web server or firewall rules.", "Implement a web application firewall or regex\u2011based input filtering to reject malicious SQL patterns targeting the ChannelName parameter."], "summary": {"action": "Immediate Patch", "impact": "Remote SQL Injection"}, "threat_synthesis": {"affected_systems": "Fujian Smart Integrated Management Platform System, versions up to 7.5, includes the XCamera.ashx handler under /Module/CRXT/Controller/. The affected function is undocumented, but any installation of the platform prior to 7.5 runs with the vulnerable component.", "description_and_impact": "The vulnerability allows an attacker to manipulate the ChannelName parameter in the XCamera.ashx endpoint to inject arbitrary SQL commands. When the attack succeeds, the attacker can read, modify or delete data stored in the underlying database, potentially compromising confidentiality, integrity, or availability of system information. The flaw is a classic SQL injection described by CWE\u201174 and CWE\u201189.", "risk_and_exploitability": "The CVSS score is 6.9, indicating a moderate severity. EPSS shows a very low exploitation probability of less than 1%. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to send a specially crafted HTTP request to the vulnerable endpoint, which is reachable from the internet or internal network, and has no known mitigations in place. Consequently, the risk is considered moderate but manageable with prompt remediation."}}}}, "created": "2026-02-20T09:52:48.105597+00:00", "updated": "2026-04-17T17:45:24.336834+00:00", "vendors": ["fujian", "fujian$PRODUCT$smart_integrated_management_platform_system"]}