CVE-2026-3969 identifies a SQL Injection vulnerability in FeMiner wms up to version 1.0, located in the Basic Organizational Structure Module within the file /wms-master/src/basic/depart/depart_add_bg.php. The flaw is triggered by manipulating the 'Name' parameter, which is not properly sanitized before being incorporated into SQL queries. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to unauthorized data retrieval, modification, or deletion in the backend database. The vulnerability does not require any user interaction or privileges, making it easier to exploit. The CVSS v4.0 score of 6.9 reflects a medium severity, considering the network attack vector, low complexity, and no required authentication, but limited scope and impact on confidentiality, integrity, and availability. The vendor was contacted but has not issued any patch or response, and the exploit code is publicly available, increasing the risk of exploitation. No known active exploitation has been reported yet. The vulnerability affects only version 1.0 of FeMiner wms, a warehouse management system, which may be used in logistics and supply chain environments.

The SQL Injection vulnerability in FeMiner wms 1.0 can have significant impacts on organizations relying on this software for warehouse management and logistics. Exploitation can lead to unauthorized access to sensitive organizational data, including potentially confidential business information stored in the database. Attackers could modify or delete critical data, disrupting operations and causing data integrity issues. In worst cases, attackers might escalate the attack to compromise the underlying database server or pivot to other internal systems. The lack of authentication and user interaction requirements increases the risk of automated mass exploitation attempts, especially since the exploit is publicly available. This can result in data breaches, operational downtime, and reputational damage. Organizations without timely mitigation or compensating controls remain vulnerable to these risks.

Since no official patch is available from the vendor, organizations should implement immediate compensating controls. First, apply strict input validation and sanitization on the 'Name' parameter at the web application firewall (WAF) or reverse proxy level to block malicious SQL payloads. Employ parameterized queries or prepared statements if source code access and modification is possible to fix the root cause. Restrict network access to the affected module by limiting exposure to trusted IP addresses or VPNs. Monitor logs for unusual database query patterns or repeated attempts to exploit the vulnerable parameter. Conduct regular database backups to enable recovery in case of data tampering. Engage with the vendor for updates and consider migrating to alternative, supported warehouse management solutions if feasible. Additionally, implement network segmentation to isolate the affected system and reduce lateral movement risk.