CVE-2026-18970

HighCVSS 7.3

Published: 06/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

17th percentile - higher than 17% of all known CVEs

Summary

A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617, affecting an unknown function in the file /dm/dispatch/user/findAll. Manipulation of the Name argument leads to SQL injection. The attack can be launched remotely, and the exploit has been published.

Risk Assessment

An attacker can execute arbitrary SQL queries, potentially leading to disclosure, modification, or deletion of database data, as well as account takeover.

Recommendation

Update the platform to the latest patched version. Use parameterized queries and input validation in the findAll function.

Other vulnerabilities in Rongzhitong Visual Integrated Command and Dispatch Platform

CVE-2026-18969High
A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617, affecting an unknown function in the file /dm/dispatch/userinfo/upload. Manipulation of the File argument results in unrestricted upload. The attack can be initiated remotely, and the exploit is public.

Original NVD description (English source)

A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.