CVE-2026-50782

HighCVSS 7.5

Published: 29/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

28th percentile - higher than 28% of all known CVEs

Summary

XML External Entity (XXE) vulnerability in Jinher OA C6. An unauthenticated remote attacker can send a crafted XML payload to the GetXmlHttp endpoint to read arbitrary files from the server via an out-of-band attack.

Risk Assessment

Leakage of sensitive system files, such as configurations or credentials.

Recommendation

Disable external XML entity processing in the XML parser or update to a patched version.

Other vulnerabilities in Jinher OA C6

CVE-2026-11412Medium
In Jinher OA C6, an SQL injection vulnerability was found in the file /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx. Manipulating the queryID argument allows remote attack. The exploit is public, and the vendor did not respond.

Original NVD description (English source)

Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack.