CVE-2026-1449

Hisense TransTech Smart Bus Management System TireMng.aspx Page_Load sql injection

CVSS 6.9 MEDIUMEPSS 0.4%CWE-74 CWE-89

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 6.9EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

26 jan 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A flaw has been found in Hisense TransTech Smart Bus Management System up to 20260113. Affected is the function Page_Load of the file YZSoft/Forms/XForm/BM/BusComManagement/TireMng.aspx. Executing a manipulation of the argument key can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Produtos afetados

Hisense TransTech · Smart Bus Management System

Referências

https://github.com/master-abc/cve/issues/15 https://vuldb.com/?ctiid.342881 https://vuldb.com/?id.342881 https://vuldb.com/?submit.737032