CVE-2026-78182: Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System plansImmediate PlanController.getImmediatePlans sql injection
A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to 300R004C00B300. The affected element is the function PlanController.getImmediatePlans of the file /xbreport/api/v1/plamange/plansImmediate. The manipulation of the argument order/sort leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates that the issue is remotely reachable over the network, requires no privileges and no user interaction, and has low attack complexity.
Which deployments should be treated as potentially exposed?
Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System versions up to and including 300R004C00B300 are identified as affected. Exposure depends on whether the /xbreport/api/v1/plamange/plansImmediate endpoint is remotely accessible.
What is the expected impact if exploitation succeeds?
The reported CVSS metrics rate confidentiality, integrity, and availability impact as low, with unchanged scope. The flaw is an SQL injection involving the order and sort arguments.
Is there evidence that attackers may already have exploit material?
Yes. The vulnerability information states that an exploit has been publicly disclosed and may be used.