CVE-2026-9465
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
SQL Injection vulnerability in /Easy7/apps/WebService/GetDBDataEx.jsp of Tiandy Easy7 Integrated Management Platform 7.17.0. Manipulation of strTBName argument leads to SQL injection. Remote attack, exploit public. Vendor did not respond.
Risk Assessment
Risk of remote SQL injection, potentially leading to data leakage and database integrity compromise.
Recommendation
Immediately implement parameterized SQL queries for the strTBName argument in GetDBDataEx.jsp.
Other vulnerabilities in Tiandy Easy7 Integrated Management Platform
See all- CVE-2026-7698High
A vulnerability was identified in Tiandy Easy7 Integrated Management Platform version 7.17.0, affecting an unknown functionality of the file /Easy7/rest/systemInfo/updateDbBackupInfo. Manipulation of the argument week leads to OS command injection.
- CVE-2026-9466Medium
Tiandy Easy7 Integrated Management Platform version 7.17.0 has a vulnerability in the /rest/user/updateUserPassword API endpoint. Manipulation can lead to weak password recovery. The attack can be executed remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/GetDBDataEx.jsp. Performing a manipulation of the argument strTBName results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.