CVE-2026-4597: SQL Injection in 648540858 wvp-GB28181-pro
A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. Impacted is the function selectAll of the file src/main/java/com/genersoft/iot/vmp/streamProxy/dao/provider/StreamProxyProvider.java of the component Stream Proxy Query Handler. The manipulation results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AI Analysis
Technical Summary
This vulnerability affects the selectAll function in src/main/java/com/genersoft/iot/vmp/streamProxy/dao/provider/StreamProxyProvider.java of wvp-GB28181-pro versions 2.7.0 through 2.7.4. It allows remote attackers to perform SQL injection by manipulating input parameters processed by the Stream Proxy Query Handler component. The vulnerability is confirmed and publicly disclosed with exploit code available. The vendor has not issued a response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation could allow an attacker to execute arbitrary SQL commands remotely against the affected system's database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. No known active exploitation has been reported yet.
Mitigation Recommendations
No official patch or remediation is currently available from the vendor. Since the vendor did not respond to disclosure and no patch links are provided, users should consider implementing application-layer mitigations such as input validation and query parameterization if possible. Monitor vendor channels for any future updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-4597: SQL Injection in 648540858 wvp-GB28181-pro
Description
A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. Impacted is the function selectAll of the file src/main/java/com/genersoft/iot/vmp/streamProxy/dao/provider/StreamProxyProvider.java of the component Stream Proxy Query Handler. The manipulation results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the selectAll function in src/main/java/com/genersoft/iot/vmp/streamProxy/dao/provider/StreamProxyProvider.java of wvp-GB28181-pro versions 2.7.0 through 2.7.4. It allows remote attackers to perform SQL injection by manipulating input parameters processed by the Stream Proxy Query Handler component. The vulnerability is confirmed and publicly disclosed with exploit code available. The vendor has not issued a response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation could allow an attacker to execute arbitrary SQL commands remotely against the affected system's database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. No known active exploitation has been reported yet.
Mitigation Recommendations
No official patch or remediation is currently available from the vendor. Since the vendor did not respond to disclosure and no patch links are provided, users should consider implementing application-layer mitigations such as input validation and query parameterization if possible. Monitor vendor channels for any future updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-03-22T14:42:56.401Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 69c1a302f4197a8e3b8aa1e9
Added to database: 3/23/2026, 8:30:58 PM
Last enriched: 4/18/2026, 1:42:54 PM
Last updated: 5/8/2026, 3:08:13 PM
Views: 85
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.