The vulnerability CVE-2026-37429 affects qihang-wms through a SQL injection in the datascope parameter within the SysUserMapper.xml file. This allows an unauthenticated attacker to perform SQL injection attacks, potentially exposing sensitive user data stored in the database. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity but not availability. No vendor advisory or patch information is currently available, and the software is not a cloud service.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive database information, including Personally Identifiable Information (PII) of users. The integrity of the database could also be compromised. There is no indication that availability is affected. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected parameter and monitor for suspicious database queries related to the datascope parameter. Avoid exposing the vulnerable interface to untrusted networks where possible.