CVE-2026-14737

HIGH

Hanwang e-Face General Management Platform querySysAuthStr.do sql injection

Title source: cna

Description

A vulnerability was identified in Hanwang e-Face General Management Platform 6.3.5.4. This impacts an unknown function of the file /sysAuthStr/querySysAuthStr.do. The manipulation of the argument order leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

References (5)

Core 5

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-376320 | Hanwang e-Face General Management Platform querySysAuthStr.do sql injection

https://vuldb.com/vuln/376320

Signature, Permissions Required signature permissions-required

VDB-376320 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/376320/cti

Third Party Advisory third-party-advisory

CVE-2026-14737 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-14737

Third Party Advisory third-party-advisory

Submit #848640 | Hanwang Technology Co., Ltd. e-FacePass Integrated Management Platform V6.3.5.4 CWE-89 (Unauthenticated SQL Injection)

https://vuldb.com/submit/848640

Exploit exploit

https://ucn9h68n9289.feishu.cn/docx/RWItdiw5Go02UsxHxgNcMWBqnJc?from=from_copylink

Scores

CVSS v3 7.3

EPSS 0.0026

EPSS Percentile 17.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-74 CWE-89

Status published

Products (1)

Hanwang/e-Face General Management Platform 6.3.5.4

Published Jul 05, 2026

Tracked Since Jul 05, 2026