What is the CVSS score of CVE-2026-37430?

CVE-2026-37430 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of qihang-wms are affected by CVE-2026-37430?

CVE-2026-37430 is a critical arbitrary file upload vulnerability in qihang-wms (启航电商WMS) that permits unauthenticated attackers to upload and execute malicious code through the…

qihang-wms CVE-2026-37430

EUVD-2026-29949 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-13 mitre

GHSA-xf7x-xwx7-4g6h

RCE Java File Upload N A

7.3

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 14, 2026 - 20:24 vuln.today

CVSS changed

May 14, 2026 - 20:22 NVD

7.3 (HIGH)

CVE Published

May 13, 2026 - 00:00 nvd

HIGH 7.3

CVE Published

May 13, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

An arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms commit 75c15a allows attackers to execute arbitrary code via uploading a crafted file.

AnalysisAI

Arbitrary file upload in qihang-wms (启航电商WMS) allows unauthenticated remote attackers to execute arbitrary code by uploading malicious files through the ShopOrderImportController component. The vulnerability affects commit 75c15a and potentially other versions of this warehouse management system. …

RemediationAI

Within 24 hours: Identify all qihang-wms instances in production and development; immediately restrict network access to ShopOrderImportController endpoints to authorized IP ranges only. Within 7 days: Implement Web Application Firewall (WAF) rules to block file upload requests to vulnerable endpoints; conduct forensic review of upload logs for suspicious activity since deployment. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-37430 vulnerability details – vuln.today

Back