CVE-2026-9465mediumCWE-74CWE-89

CVE-2026-9465: medium-severity vulnerability in Tiandy Easy7 Integrated Management Platform

Tiandy Easy7 Integrated Management Platform GetDBDataEx.jsp sql injection

Published · Updated

Follow this CVE+ Monitor Easy7 Integrated Management Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 0.3%
A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/GetDBDataEx.jsp. Performing a manipulation of the argument strTBName results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Tiandy · Easy7 Integrated Management Platform
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Tiandy Easy7 Integrated Management Platform

In the same product, most dangerous first.

CVE-2026-4585CRITICALTiandy Easy7 Integrated Management Platform Configuration ImportSystemConfiguration.jsp os command injectionEPSS 4.6%CVE-2026-7698MEDIUMTiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injectionEPSS 2.7%CVE-2026-4187MEDIUMTiandy Easy7 Integrated Management Platform Device Identifier UpdateLocalDevInfo.jsp missing authenticationEPSS 0.6%CVE-2026-9466MEDIUMTiandy Easy7 Integrated Management Platform API Endpoint updateUserPassword password recoveryEPSS 0.4%CVE-2026-4221MEDIUMTiandy Easy7 Integrated Management Platform Endpoint uploadLedImage unrestricted uploadEPSS 0.3%CVE-2026-4289MEDIUMTiandy Easy7 Integrated Management Platform getRecByTemplateId sql injectionEPSS 0.3%