PT-2026-30433

CVE-2026-5563

Published

2026-04-05

Updated

2026-04-05

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AutohomeCorp frostmourne versions up to 1.0

Description A security flaw exists in AutohomeCorp frostmourne up to version 1.0. The httpTest function within the Alarm Preview component, accessible via the file /api/monitor-api/alarm/previewData, is susceptible to SQL injection. This attack can be initiated remotely. The exploit for this issue has been publicly released.

Recommendations Versions prior to 1.0 should be updated. As a temporary workaround, consider restricting access to the /api/monitor-api/alarm/previewData endpoint until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Xcxr

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers