Is there a public PoC exploit available for CVE-2026-9465?

Yes, a public proof-of-concept exploit is available for CVE-2026-9465. Prioritise patching immediately. EPSS: 0.0%.

Tiandy Easy7 CVE-2026-9465

Q: What is the CVSS score of CVE-2026-9465?

CVE-2026-9465 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31695 MEDIUM

SQL Injection (CWE-89)

2026-05-25 VulDB

GHSA-3g5p-qv44-mwhx

SQLi Easy7 Integrated Management Platform

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:08 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 20:07 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/GetDBDataEx.jsp. Performing a manipulation of the argument strTBName results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Unauthenticated SQL injection in Tiandy Easy7 Integrated Management Platform 7.17.0 exposes database contents to remote attackers via the strTBName parameter of the GetDBDataEx.jsp web service endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and exploit code has been made publicly available, raising the operational risk despite a relatively low EPSS score of 0.03%. The vendor was notified prior to public disclosure but did not respond, and no vendor-released patch has been identified at time of analysis.

Technical ContextAI

The affected component is a JSP-based web service endpoint (/Easy7/apps/WebService/GetDBDataEx.jsp) within Tiandy's Easy7 Integrated Management Platform, a video surveillance and IoT management solution. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input to the strTBName argument is concatenated into a database query without adequate sanitization or parameterization. The CPE string cpe:2.3:a:tiandy:easy7_integrated_management_platform:*:*:*:*:*:*:*:* uses a wildcard version field, indicating that while 7.17.0 is the confirmed affected version per EUVD, the full vulnerable version range has not been formally bounded by the vendor. The CVSS 4.0 E:P modifier confirms exploit code exists and has been factored into scoring.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to pre-disclosure contact, so no official fix or advisory exists. Administrators should immediately assess whether the GetDBDataEx.jsp endpoint is network-accessible, particularly from untrusted networks or the internet, and restrict access to it via WAF rules, firewall ACLs, or reverse proxy controls blocking requests to the /Easy7/apps/WebService/GetDBDataEx.jsp path. If the GetDBDataEx web service functionality is not operationally required, disabling or removing the JSP file from the deployment removes the attack surface entirely, though this may impact legitimate monitoring or integration workflows. Input validation at the application gateway level (blocking SQL metacharacters in the strTBName query parameter) is a partial compensating control but carries WAF evasion risk. Organizations should monitor VulDB entry https://vuldb.com/vuln/365446 and the NVD record https://nvd.nist.gov/vuln/detail/CVE-2026-9465 for vendor patch availability.