CVE-2026-3200
Published: 25 February 2026
Summary
CVE-2026-3200 is a medium-severity Injection (CWE-74) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-3200 is a SQL injection vulnerability affecting z-9527 admin versions 1.0 and 2.0. The flaw is present in the functions checkName, register, login, getUser, and getUsers within the file /server/controller/user.js.
The vulnerability enables remote attackers to initiate SQL injection attacks with network access, low attack complexity, no privileges, and no user interaction required, per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, yielding a base score of 7.3. Exploitation can result in limited impacts to confidentiality, integrity, and availability.
VulDB advisories detail the issue across entries like ctiid.347772 and id.347772, with a submission at submit.758325. Proof-of-concept exploits are publicly available in GitHub repositories at https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-1 and vulnerability-2. The vendor was contacted early but provided no response or patches.
Notable context includes the public availability of exploits, which might be used in attacks. The issue maps to CWEs 74 and 89.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8744
Vulnerability details
A vulnerability was identified in z-9527 admin 1.0/2.0. The affected element is the function checkName/register/login/getUser/getUsers of the file /server/controller/user.js. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.…
more
The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a remotely accessible web admin application (login/register/user functions) directly enables unauthenticated exploitation of a public-facing or network-exposed app per the AV:N/PR:N CVSS vector.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted inputs to the checkName/register/login/getUser/getUsers functions, blocking the SQL injection payload before it reaches the database.
Enables continuous monitoring and analysis of application and database query logs to identify anomalous SQL statements originating from the publicly available exploit against user.js.
Requires timely remediation of the identified flaw in the affected controller functions, eliminating the SQL injection vulnerability once a patch or code fix is applied.