CVE-2026-5563

MediumCVSS 6.3

Published: 05/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

SQL Injection vulnerability in AutohomeCorp frostmourne up to version 1.0. The httpTest function in /api/monitor-api/alarm/previewData in Alarm Preview component allows manipulation leading to SQL injection. Remote attack possible. Exploit published.

Risk Assessment

A remote attacker can execute arbitrary SQL queries, potentially leading to leakage of monitored system data or alarm configuration modification.

Recommendation

Immediately update frostmourne to a patched version or use parameterized queries.

Original NVD description (English source)

A security flaw has been discovered in AutohomeCorp frostmourne up to 1.0. Affected is the function httpTest of the file /api/monitor-api/alarm/previewData of the component Alarm Preview. The manipulation results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.