CVE-2026-78182

Name of the Vulnerable Software and Affected Versions Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System versions prior to 300R004C00B300

Description An issue exists where manipulation of the order or sort arguments in the PlanController.getImmediatePlans() function of the '/xbreport/api/v1/plamange/plansImmediate' endpoint allows for remote SQL injection. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System to a version later than 300R004C00B300. As a temporary workaround, restrict access to the '/xbreport/api/v1/plamange/plansImmediate' endpoint or avoid using the order and sort parameters until the system is updated.