CVE-2026-11435 is a SQL injection vulnerability affecting Jinher OA 1.0. The issue arises from improper sanitization of the httpOID argument in the nextselectplan.aspx file, enabling remote attackers to inject malicious SQL commands. The vulnerability is publicly disclosed, but the vendor has not provided a fix or guidance. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to medium impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. The impact is rated medium based on the CVSS score of 6.9. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as input validation, web application firewalls (WAFs) with SQL injection detection, or restricting access to the vulnerable endpoint until a patch is released.