Threats tagged 'ghsa-hqjm-pcjx-j2gf'

CVE-2026-18970 is a SQL injection vulnerability in the Rongzhitong Visual Integrated Command and Dispatch Platform up to version 20260617. The flaw exists in an unknown function within the /dm/dispatch/user/findAll file, where manipulation of the 'Name' argument can lead to SQL injection. The vulnerability can be exploited remotely. The vendor was contacted but did not respond, and no patch or remediation is currently available. The CVSS 4.0 base score is 6.9, indicating a medium severity level.