CVE-2026-4597
648540858 wvp-GB28181-pro Stream Proxy Query StreamProxyProvider.java selectAll sql injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Mar 23, 2026
- Updated
- Apr 18, 2026
- Reserved
- Mar 22, 2026
Description
A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. Impacted is the function selectAll of the file src/main/java/com/genersoft/iot/vmp/streamProxy/dao/provider/StreamProxyProvider.java of the component Stream Proxy Query Handler. The manipulation results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
wvp-GB28181-pro648540858 |
|
References
- VDB-352435 | 648540858 wvp-GB28181-pro Stream Proxy Query StreamProxyProvider.java selectAll sql injectionvdb-entrytechnical-description
- VDB-352435 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #775635 | 648540858 wvp-GB28181-pro WVP <= v2.7.4 SQL Injectionthird-party-advisory
- Submit #780377 | 648540858 (GitHub) wvp-GB28181-pro master branch — commit to be confirmed (see repository for latest hash) SQL Injection (Duplicate)third-party-advisory
- https://fx4tqqfvdw4.feishu.cn/docx/MwZRdLmXhosJJFxCQ2kcJjfqnhk?from=from_copylinkexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.