The vulnerability CVE-2026-37428 involves a SQL injection in the qihang-wms system, triggered through the datascope parameter in the SysDeptMapper.xml file. This injection flaw enables unauthorized access to sensitive database content, including PII. The lack of patch information and remediation level indicates that no official fix has been confirmed yet. No CVSS score is provided, and no exploits have been documented in the wild as of the published date.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive database information, including users' Personally Identifiable Information (PII). This exposure could result in privacy violations and potential downstream impacts depending on the nature of the compromised data. There is no evidence of active exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to review and sanitize inputs to the datascope parameter and apply any available security controls to limit database access. Monitor vendor channels for updates regarding patches or official mitigations.