CVE-2026-9551

HighCVSS 7.3

Published: 26/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

A SQL injection vulnerability was identified in Das Parking Management System 停车场管理系统 6.2.0 in the xp_cmdshell function of the ParkingRecord/ExportParkingRecords file within the API endpoint. Manipulation of the Value argument allows remote attack execution. The exploit is publicly available and may be used.

Risk Assessment

An attacker can remotely execute arbitrary SQL queries, potentially leading to data leakage or modification in the parking database.

Recommendation

Immediately update the system to the latest version or apply temporary mitigations such as input validation and parameterized queries.

Other vulnerabilities in Das Parking Management System

CVE-2026-9552High
A security flaw has been discovered in Das Parking Management System 6.2.0. This vulnerability affects unknown code of the component Search API Endpoint. The manipulation of the argument Value results in SQL injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted but did not respond.

Original NVD description (English source)

A vulnerability was identified in Das Parking Management System 停车场管理系统 6.2.0. This affects the function xp_cmdshell of the file ParkingRecord/ExportParkingRecords of the component API Endpoint. The manipulation of the argument Value leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.