CVE-2026-11412

MediumCVSS 6.3

Published: 06/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

In Jinher OA C6, an SQL injection vulnerability was found in the file /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx. Manipulating the queryID argument allows remote attack. The exploit is public, and the vendor did not respond.

Risk Assessment

An attacker can remotely manipulate the database, potentially leading to data leakage or privilege escalation.

Recommendation

Immediately isolate the system from external networks and deploy a web application firewall until a patch is available.

Other vulnerabilities in Jinher OA C6

CVE-2026-50782High
XML External Entity (XXE) vulnerability in Jinher OA C6. An unauthenticated remote attacker can send a crafted XML payload to the GetXmlHttp endpoint to read arbitrary files from the server via an out-of-band attack.

Original NVD description (English source)

A weakness has been identified in Jinher OA C6. The affected element is an unknown function of the file /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx. Executing a manipulation of the argument queryID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.