CVE-2026-1121: Yonyou KSOA HTTP GET Parameter del_workplan.jsp sql injection

Published Jan 18, 2026

Updated

A vulnerability was found in Yonyou KSOA 9.0. This affects an unknown function of the file /worksheet/delworkplan.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Yonyou KSOA

Yonyou KSOA=9.0

Event History

Jan 18, 2026

CVE Published

via MITRE·01:32 PM

Data Sourced

via MITRE·01:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-1121?

CVE-2026-1121 is categorized as a high severity vulnerability due to its potential for SQL injection attacks.

How do I fix CVE-2026-1121?

To fix CVE-2026-1121, validate and sanitize the input parameters to prevent SQL injection.

What systems are affected by CVE-2026-1121?

CVE-2026-1121 affects the Yonyou KSOA application version 9.0.

What type of vulnerability is CVE-2026-1121?

CVE-2026-1121 is an SQL injection vulnerability affecting the HTTP GET Parameter Handler.

Can CVE-2026-1121 be exploited remotely?

Yes, CVE-2026-1121 can be exploited remotely through crafted HTTP GET requests.