Is there a public PoC exploit available for CVE-2026-11412?

Yes, a public proof-of-concept exploit is available for CVE-2026-11412. Prioritise patching immediately. EPSS: 0.0%.

Jinher OA C6 CVE-2026-11412

Q: What is the CVSS score of CVE-2026-11412?

CVE-2026-11412 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34967 LOW

SQL Injection (CWE-89)

2026-06-06 VulDB

GHSA-5422-5257-mh57

SQLi Oa Jinher

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 11:30 vuln.today

Severity Changed

Jun 06, 2026 - 11:22 NVD

MEDIUM LOW

CVSS changed

Jun 06, 2026 - 11:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A weakness has been identified in Jinher OA C6. The affected element is an unknown function of the file /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx. Executing a manipulation of the argument queryID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Jinher OA C6's GetFormSn.aspx endpoint allows remote low-privilege authenticated attackers to manipulate the queryID parameter, potentially reading, modifying, or deleting backend database records. A public proof-of-concept exploit is available on GitHub, lowering the barrier to exploitation. No patch exists - the vendor was notified early but did not respond, leaving no official remediation path.

Technical ContextAI

The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) affecting Jinher OA, a Chinese enterprise office automation platform. The affected endpoint /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx - likely a form serial number generation function - passes the queryID HTTP parameter directly into a SQL query without adequate sanitization or parameterization. CPE cpe:2.3:a:jinher:oa:*:*:*:*:*:*:*:* indicates the wildcard covers all tracked versions of the product with no lower or upper boundary confirmed. The ASP.NET-based web component (suggested by the .aspx extension) is a server-side handler, meaning the injection point is processed at the application tier, not the client.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, and no fix version exists in available data. Compensating controls should include: deploying WAF rules targeting SQL injection patterns on the queryID parameter for requests to /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx (trade-off: may break legitimate functionality if query values contain special characters); restricting access to the Jinher OA web interface to trusted internal network segments via firewall or network ACL to eliminate external attack surface; auditing and applying least-privilege to the database account used by the OA application to limit the blast radius of a successful injection; and enabling database query logging to detect anomalous SQL patterns indicative of exploitation. Monitor the VulDB advisory at https://vuldb.com/vuln/368969 for any future vendor patch release.