Alixhan xh-admin-backend Database Query query sql injection_CVE-2026-2663

5.3 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Description

A security vulnerability has been detected in Alixhan xh-admin-backend up to 1.7.0. This issue affects some unknown processing of the file /frontend-api/system-service/api/system/role/query of the component Database Query Handler. Such manipulation of the argument prop leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Basic Information

ID CVE-2026-2663

Source VulDB

Published Feb 18, 2026 at 19:32

Modified Feb 18, 2026 at 20:04

Affected Product

Vendor Alixhan

Product xh-admin-backend

Version 1.0

Affected Versions Alixhan xh-admin-backend 1.0
Alixhan xh-admin-backend 1.1
Alixhan xh-admin-backend 1.2
Alixhan xh-admin-backend 1.3
Alixhan xh-admin-backend 1.4
Alixhan xh-admin-backend 1.5
Alixhan xh-admin-backend 1.6
Alixhan xh-admin-backend 1.7.0

CWE Classification

CWE-89 CWE-74

References

{
    "lastseen": "",
    "description": "A security vulnerability has been detected in Alixhan xh-admin-backend up to 1.7.0. This issue affects some unknown processing of the file /frontend-api/system-service/api/system/role/query of the component Database Query Handler. Such manipulation of the argument prop leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
    "published": "2026-02-18T19:32:09.406Z",
    "modified": "2026-02-18T20:04:19.115Z",
    "type": "cve",
    "title": "Alixhan xh-admin-backend Database Query query sql injection",
    "source": "VulDB",
    "references": "https://vuldb.com/?id.346461\nhttps://vuldb.com/?ctiid.346461\nhttps://vuldb.com/?submit.753225",
    "id": "CVE-2026-2663",
    "bulletinFamily": "",
    "cwe": [
        "CWE-89",
        "CWE-74"
    ],
    "cvelist": null,
    "sourceData": "Alixhan xh-admin-backend 1.0\nAlixhan xh-admin-backend 1.1\nAlixhan xh-admin-backend 1.2\nAlixhan xh-admin-backend 1.3\nAlixhan xh-admin-backend 1.4\nAlixhan xh-admin-backend 1.5\nAlixhan xh-admin-backend 1.6\nAlixhan xh-admin-backend 1.7.0",
    "sourceHref": "",
    "cvss": {
        "score": 5.3,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "xh-admin-backend",
    "version": "1.0",
    "vendor": "Alixhan",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}