What is the CVSS score of EUVD-2026-29948?

EUVD-2026-29948 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

qihang-wms EUVD-2026-29948

| CVE-2026-37429 MEDIUM

SQL Injection (CWE-89)

2026-05-13 mitre

GHSA-vm77-62fc-6c28

SQLi N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:39 vuln.today

CVSS changed

May 13, 2026 - 19:22 NVD

6.5 (MEDIUM)

CVE Published

May 13, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysUserMapper.xml file. This vulnerability allows attackers to access sensitive database information, including users' Personally Identifiable Information (PII) via a crafted SQL statement.

AnalysisAI

SQL injection in qihang-wms (commit 75c15a) exposes sensitive database contents, including user PII, to unauthenticated remote attackers via the datascope parameter in SysUserMapper.xml. The vulnerability requires no authentication, no user interaction, and is reachable over the network, making automated exploitation feasible. SSVC assessment confirms exploitation has not been observed and EPSS sits at 0.03% (9th percentile), indicating low current exploitation interest despite the permissive attack surface.

Technical ContextAI

qihang-wms is a Chinese e-commerce warehouse management system. The vulnerability resides in SysUserMapper.xml, a MyBatis ORM mapper file - a Java persistence framework that constructs SQL from XML-defined templates. MyBatis is susceptible to SQL injection when dynamic query fragments (e.g., ${} interpolation rather than #{} parameterized binding) are used without sanitization. The datascope parameter appears to be passed directly into a SQL clause without parameterization, satisfying CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The affected product version is pinned to a specific Git commit (75c15a) rather than a named release, indicating this is an open-source project tracked by commit hash. CPE data returned as n/a means no official NVD product tree entry exists for this software, complicating automated scanner detection.

RemediationAI

No vendor-released patched version has been identified at time of analysis; the fix version is not independently confirmed from available data. Organizations running qihang-wms at or before commit 75c15a should review the SysUserMapper.xml file and convert any ${} dynamic SQL interpolation on the datascope parameter to MyBatis parameterized #{} bindings, which enforce prepared statement semantics and eliminate injection. As a compensating control, restrict network access to the WMS application to trusted internal networks only, preventing unauthenticated internet-facing exploitation - this directly counters the AV:N/PR:N attack vector but does not fix the underlying flaw. Additionally, apply database least-privilege principles: ensure the WMS database account cannot read user PII tables beyond application requirements. The researcher disclosure is documented at https://github.com/Y4y17/CVE/blob/main/%E5%90%AF%E8%88%AA%E7%94%B5%E5%95%86WMS/SQL%20Injection%20Vulnerability%20-%202.md and https://gist.github.com/Y4y17/6587147a37eba5b31de832e067f317ef, which may contain additional technical detail useful for patch verification.