{"id":"CVE-2026-3969","state":"PUBLISHED","title":"FeMiner wms Basic Organizational Structure depart_add_bg.php sql injection","description":"A vulnerability was detected in FeMiner wms up to 1.0. This impacts an unknown function of the file /wms-master/src/basic/depart/depart_add_bg.php of the component Basic Organizational Structure Module. Performing a manipulation of the argument Name results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-03-12T00:32:09.978Z","updatedAt":"2026-03-12T16:21:32.572Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["FeMiner wms"],"affected":[{"vendor":"FeMiner","product":"wms","versions":[{"version":"1.0","status":"affected"}],"modules":["Basic Organizational Structure Module"]}],"references":["https://vuldb.com/?id.350404","https://vuldb.com/?ctiid.350404","https://vuldb.com/?submit.768977","https://github.com/yuan384/cve/issues/3"],"weaknesses":["CWE-89","CWE-74"],"ingestedAt":"2026-10-29T20:11:50.837Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/3xxx/CVE-2026-3969.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-3969","state":"PUBLISHED","datePublished":"2026-03-12T00:32:09.978Z","dateUpdated":"2026-03-12T16:21:32.572Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-03-11T13:49:01.872Z"},"containers":{"cna":{"title":"FeMiner wms Basic Organizational Structure depart_add_bg.php sql injection","descriptions":[{"lang":"en","value":"A vulnerability was detected in FeMiner wms up to 1.0. This impacts an unknown function of the file /wms-master/src/basic/depart/depart_add_bg.php of the component Basic Organizational Structure Module. Performing a manipulation of the argument Name results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"FeMiner","product":"wms","versions":[{"version":"1.0","status":"affected"}],"modules":["Basic Organizational Structure Module"]}],"references":[{"url":"https://vuldb.com/?id.350404","name":"VDB-350404 | FeMiner wms Basic Organizational Structure depart_add_bg.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.350404","name":"VDB-350404 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.768977","name":"Submit #768977 | https://github.com/FeMiner/wms Enterprise Warehouse Management System V1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/yuan384/cve/issues/3","tags":["exploit","issue-tracking"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"SQL Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-03-12T00:32:09.978Z"},"timeline":[{"time":"2026-03-11T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-03-11T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-03-11T14:54:05.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"yuan384 (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB","type":"coordinator"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-12T16:21:25.534624Z","id":"CVE-2026-3969","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-12T16:21:32.572Z"}}]}}}