Description
A weakness has been identified in Huace Monitoring and Early Warning System 2.2. Affected by this issue is some unknown functionality of the file /Web/SysManage/ProjectRole.aspx. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-02-17
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in Huace Monitoring and Early Warning System version 2.2 within the ProjectRole.aspx page. Manipulating the ID argument allows an attacker to inject arbitrary SQL statements, potentially gaining unauthorized read or write access to the backend database. This SQL injection can lead to data exposure, alteration, or deletion, compromising confidentiality and integrity of the system’s data.

Affected Systems

Affected is the Huace Monitoring and Early Warning System product produced by Huace, specifically the Web/SysManage/ProjectRole.aspx component used in version 2.2. The exact version number is 2.2; no other affected versions are listed.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity vulnerability, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild at the time of assessment. However, the exploit code is publicly available, and the attack can be launched remotely without authentication. The vulnerability is not listed in the CISA KEV catalog, but the combination of remote access and injection capability represents a significant risk to data security.

Generated by OpenCVE AI on April 16, 2026 at 17:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and apply any vendor‑proposed security patch or update for the Huace Monitoring and Early Warning System 2.2.
  • If no patch is available, enforce strict input validation on the ID parameter—allow only numeric characters and enforce maximum length limits.
  • Deploy a Web Application Firewall or similar filtering to detect and block SQL injection attempts against the ProjectRole.aspx endpoint.

Generated by OpenCVE AI on April 16, 2026 at 17:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 18 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Huace
Huace monitoring And Early Warning System
Vendors & Products Huace
Huace monitoring And Early Warning System

Tue, 17 Feb 2026 19:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Huace Monitoring and Early Warning System 2.2. Affected by this issue is some unknown functionality of the file /Web/SysManage/ProjectRole.aspx. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Huace Monitoring and Early Warning System ProjectRole.aspx sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Huace Monitoring And Early Warning System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-06T15:35:51.064Z

Reserved: 2026-02-17T09:15:05.053Z

Link: CVE-2026-2620

cve-icon Vulnrichment

Updated: 2026-03-06T15:35:42.461Z

cve-icon NVD

Status : Deferred

Published: 2026-02-17T20:22:10.593

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-2620

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T17:15:17Z

Weaknesses